Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering takeovers of open source projects

openssf.org

Post reply on HN
Print view View original

161–170 of 379 posts

Re: Social engineering takeovers of open source projects

#161

Post by lazyasciiart »

greatgib wrote: post #121

First I think that it is wrong to single out this issue on Open Source projects. For example, since the first versions of app stores, when you are an app developer you would receive a lot of messages from random shady dudes ready to buy your application if it had a few users. Also, the xz thing was kind of pretty smart, but it is also a thing in mind of most OSs developers that you can't trust any random contributor…

Chrome extensions have also been subject to those purchase offers for a long time.

Re: Social engineering takeovers of open source projects

#162

Post by somenameforme »

andix wrote: post #104
emodendroket wrote: post #91

Earlier quoted context omitted.

Does it matter though? They don’t have to say “I am so and so of the Egyptian intelligence service and would like to blackmail you”

They might not even use blackmail, they might just "help out" in a difficult financial situation. Some people are in severe debt, have a gambling problem, are addicted to expensive drugs, or might need a lot of money for a sick relative. There are many possibilities. The trick is finding the people that can be compromised.

I think you're going overboard on what's required. Take anybody who is simultaneously offered a substantial monetary incentive (let's say 4 years of total current/vesting comp), and also threatened with the release of something that we'll say is little more than moderately embarrassing. And this dev is being asked to do something that stands basically 0 risks of consequences/exposure for himself due to plausible deniability.

For instance, this is the heartbleed bug: "memcpy(bp, pl, payload);". You're copying (horrible naming conventions) payload bytes from pl to bp, without ensuring that the size of pl is >= payload, so an attacker can trivially get random bytes from memory. Somehow nobody caught one of the most blatant overflow vulnerabilities, even though memcpy calls are likely one of the very first places you'd check for this exact issue. Many people think it was intentional because of this, but obviously there's zero evidence, because it's basically impossible for evidence for this to exist. And so accordingly there were also 0 direct consequences, besides being in the spotlight for a few minutes and have a bunch of people ask him how it felt to be responsible for such a huge exploit. "It was a simple programming mistake" ad infinitum.

So, in this context - who's going to say no? If any group, criminal or national, wanted to corrupt people - I really don't think it'd be hard at all. Mixing the carrot and the stick really changes the dynamics vs a basic blackmail thing where it's exclusively a personal loss (and with no guarantee that the criminal won't come back in 3 months to do it again). To me, the fact we've basically never had anybody come forward claiming they were a victim of such an effort means that no agency (or criminal organization) anywhere has ever tried this, or that it works essentially 100% of the time.

Re: Social engineering takeovers of open source projects

#163

Post by armini »

dvh wrote: post #5

We've been adding features for 30+ years to open source software, they become so complex only very few people understand them anymore. Recently I looked into jfet level 2 implementation in ngspice, expecting familiar equations, but through series of small changes and maybe some DRY too, the code is almost unrecognizable. When graybeards finally retire, there will be lots of shrugs.

I've been working on thanks.dev for over two years now & reading this report is disappointing to say the least. Why not spend the time to explain the value XZ Utils created for all the commercial users & what companies can do to better supporting maintainers with hundreds of issues experiencing burnout from their unpaid work? OpenSSF should instead promote FOSS programs like https://frontendmasters.com/blog/how-were-supporting-open-so... & how they help their open source community stay active. Working in open source is a social contract & corporates need to be better citizens if they want to reduce their risk profile.

Re: Social engineering takeovers of open source projects

#165

Post by johnnyanmac »

Thorrez wrote: post #139
Aerroon wrote: post #55

Earlier quoted context omitted.

My thought immediately went to Linus Torvalds. The way he acted was tolerated in the past, but the culture was changed and it was used to force a change onto the project. Same thing with all of those Codes of Conduct that suddenly propped up.

Are you saying codes of conduct make the transmission of misinformation is inherently easier, e.g by sewing distrust in institutions or expertise, or normalizing a gish gallop argumentative style? Are you saying Linus Torvald's behaviour prevented those problems?

I think it's more that it leads to brain drain. Be it by misinformation, by discouraging anyone who doesn't fit [demographic of leadership], or by simply not giving proper code reviews in the name of politeness. All 3 ways creep up and the code base suffers from lack of care, and/or lack of talent.

We can certainly debate how effective old methods were (and yes, I have no doubt Torvald's old behavior turned off many a talent) and how we can improve on them, but in a more general viewpoint we need to remember that many open source code bases are, or started as, volunteers providing their knowledge in their free time. It doesn't take much to make them walk to the next repo. Or not contribute to OS at all.

Re: Social engineering takeovers of open source projects

#166

Post by armini »

__MatrixMan__ wrote: post #109
triblemaster wrote: post #54

Earlier quoted context omitted.

How about simply paying the maintainers and then getting stuff done like the classical business does.

Well yes, sounds great, but it doesn't really address the security problem. Now you've just got the bad guys getting two paychecks instead of one and the good guys getting one paycheck instead of zero.

One of the biggest risks for companies is securing dormant code, it's perfectly fine for a project to be no longer sexy enough to maintain. Platforms like thanks.dev have already proven how reward & recognition can help promote development in an ecosystem https://www.youtube.com/watch?v=e5FV-AnKPlo&t=1s

Re: Social engineering takeovers of open source projects

#169

Post by bruce511 »

armini wrote: post #163
dvh wrote: post #5

We've been adding features for 30+ years to open source software, they become so complex only very few people understand them anymore. Recently I looked into jfet level 2 implementation in ngspice, expecting familiar equations, but through series of small changes and maybe some DRY too, the code is almost unrecognizable. When graybeards finally retire, there will be lots of shrugs.

I've been working on thanks.dev for over two years now & reading this report is disappointing to say the least. Why not spend the time to explain the value XZ Utils created for all the commercial users & what companies can do to better supporting maintainers with hundreds of issues experiencing burnout from their unpaid work? OpenSSF should instead promote FOSS programs like https://frontendmasters.com/blog/how-were-…

On first reading your comment makes a lot of sense, and is certainly logical for maximizing the common good.

But unfortunately, companies simply don't work the way you are proposing.

The short reason is this "good citizenship is indistinguishable from corruption. Therefore good company governance leans away from both."

The somewhat longer answer is that while a "company" might have a lot of money, or might make a lot of money leveraging some common good, it is not (usually) one person's money.

The bigger the company the harder it gets to actually -spend- the money. There are procurement departments, various sign-offs and so on. First and foremost it helps if there is a tangible (defendable) reason to spend the money.

Yes, companies "give" money away. Usually under the guise of marketing. It's easy to donate money to the local cancer center. It's harder to explain the marketing value of supporting random open source projects.

For tech companies it's -somewhat- easier, but even then it's simpler to donate time rather than money.

I've said it a lot lately, but OSS development has to "commercialize" if it wants to be commercial. That means first understanding "what companies pay for" and designing products to fit that.

Or target individuals with excess cash of their own that they're willing to just "pass along".

Post reply on HN