So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D
[flagged]
Social engineering takeovers of open source projects
181–190 of 379 posts
Re: Social engineering takeovers of open source projects
#182So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D
US gov has encouraged finance/tech industry to invest in the security of OSS supply chains. OpenSSF members: https://openssf.org/about/members 2021, $10MM, https://openssf.org/press-release/2021/10/13/open-source-sec... > Financial commitments from Premier members include Amazon, Cisco, Dell Technologies, Ericsson, Facebook, Fidelity, GitHub, Google, IBM, Intel, JPMorgan Chase, Microsoft, Morgan Stanley, Oracle, Red…
Neat that jQuery gets so much. I guess they have a ton of stuff on jQuery still (and probably will forever).
Re: Social engineering takeovers of open source projects
#183Earlier quoted context omitted.
>If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. Unforuntately it's easy to sandbag being dumb. Just because someone submits a PR defining constants for 0-999 does not mean they're actually bad at programming.
> defining constants for 0-999 That person might just be an old school Java <5 developer.
That person might just be a regular Java developer who works on a project which onboarded Checkstyle, and can't disable it's MagicNumber check.
https://checkstyle.sourceforge.io/checks/coding/magicnumber....
Re: Social engineering takeovers of open source projects
#184Earlier quoted context omitted.
The ideal state is having the world's superpowers all devoting effort to improving open source libraries, but all catching each others' backdoors and at the end of the day improving security for everyone.
Web of trust, but all commits must be signed by at least 3 intelligence agencies from rival countries.
“Web of distrust”
Re: Social engineering takeovers of open source projects
#185So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D
[flagged]
I think he was making a tounge in cheek point about how we could finally get extremely well-founded open source projects.
Re: Social engineering takeovers of open source projects
#186Earlier quoted context omitted.
The ideal state is having the world's superpowers all devoting effort to improving open source libraries, but all catching each others' backdoors and at the end of the day improving security for everyone.
Web of trust, but all commits must be signed by at least 3 intelligence agencies from rival countries.
At least 2 rival legal Jurisdictions/Alliances/Spheres
At least 2 rival state intelligence Agencies per Sphere
At least 2 rival corporations per Sphere
TOTAL: 2*(2+2) = 8
Re: Social engineering takeovers of open source projects
#187Earlier quoted context omitted.
That's great that you are considering this more now. But the xy story taught us, that every contributor is dangerous, the most dangerous ones are probably the most helpful and most skilled contributors. If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Compromising…
[flagged]
> So we've had what, two incidents (xz and eventstream) in how many years?
This is specious reasoning.
You're only complaining you only heard of two incidents.
What you're really pointing out is that this attack vector works reliably well and is reproducible across projects.
You're also pointing out that this attack vector will continue to work until something is done to mitigate it.
I really do not understand what point you think you are making.
Re: Social engineering takeovers of open source projects
#188Earlier quoted context omitted.
[flagged]
I think he was making a tounge in cheek point about how we could finally get extremely well-founded open source projects.
I did not referred to the funding remark. It is besides the point and immaterial to the discussion.
My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and have a significant adoption rate but are not actively maintained. We are talking about Colors-like and Faker-like projects. All you need to pull this off is posting one message asking nicely for permissions, post a commit, and make a release.
Re: Social engineering takeovers of open source projects
#189So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D
[flagged]
For example NPM will give ownership to a package/module if you just ask support.
Re: Social engineering takeovers of open source projects
#190Earlier quoted context omitted.
I think he was making a tounge in cheek point about how we could finally get extremely well-founded open source projects.
I did not referred to the funding remark. It is besides the point and immaterial to the discussion. My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and ha…
The comment was not sincere and is meant to amuse.
If you believe amusement is a disservice to the community then I believe many others disagree.
edit: For clarity, the "since inception" part is an absurd setup for the, equally absurd, "well funded open source" part.