Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering takeovers of open source projects

openssf.org

Post reply on HN
Print view View original

191–200 of 379 posts

Re: Social engineering takeovers of open source projects

#191

Post by vincnetas »

euroderf wrote: post #180
bsuvc wrote: post #22

I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"

Why is there not a policy that any PR can be rewritten by a maintainer ? Wherever the PR looks a bit odd, rewrite it so do the same thing a different way. Enough unpredictable change to disrupt finely-tuned subterfuge.

you can wait for tree (or x) PR's passing specified unit tests for functionality and then merge a random one. But this is a luxury (effort wise) for any kind of project.

Re: Social engineering takeovers of open source projects

#192

Post by throwaway2037 » 

    > This approach bears strong resemblance to the manner in which “Jia Tan” positioned themselves in the XZ/liblzma backdoor.
No, it doesn't. I stopped after read this. Jia's "attack" was near state level actor stuff. A bunch of emails asking/begging for commit access sounds like a 16 year old sending emails from the basement of his parent's house.

Re: Social engineering takeovers of open source projects

#193

Post by willvarfar »

chipdart wrote: post #181
willvarfar wrote: post #168

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D

[flagged]

I edited to clarify that I was meaning future tense.

Re: Social engineering takeovers of open source projects

#195

Post by throwaway2037 »

transpute wrote: post #174
willvarfar wrote: post #168

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D

US gov has encouraged finance/tech industry to invest in the security of OSS supply chains. OpenSSF members: https://openssf.org/about/members 2021, $10MM, https://openssf.org/press-release/2021/10/13/open-source-sec... > Financial commitments from Premier members include Amazon, Cisco, Dell Technologies, Ericsson, Facebook, Fidelity, GitHub, Google, IBM, Intel, JPMorgan Chase, Microsoft, Morgan Stanley, Oracle, Red…

Why did Eclipse org get so much and Apache org none/less? In my experience, the footprint of Apache exceeds anything else in enterprise programming.

Re: Social engineering takeovers of open source projects

#196

Post by guappa »

wrsh07 wrote: post #155
andix wrote: post #13

Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases. In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent…

I'm sure some security researcher is doing this, but we could easily create a visualization of "who has contributed over time" and identify transitioning of maintainers automatically just from git. This might be worth doing and contributing to a site like bestofjs or libraries.io (I don't really use that one though!)

> who has contributed over time

When major security players insist that using GPG is bad, there is no way of knowing if bob@bob.bob is the same account that it was last month or not.

Re: Social engineering takeovers of open source projects

#197

Post by voiper1 »

transpute wrote: post #186
bee_rider wrote: post #177

Earlier quoted context omitted.

Web of trust, but all commits must be signed by at least 3 intelligence agencies from rival countries.

At least 2 rival legal Jurisdictions/Alliances/Spheres At least 2 rival state intelligence Agencies per Sphere At least 2 rival corporations per Sphere TOTAL: 2*(2+2) = 8 Widely used OSS projects are contested spheres of collaboration.

So the long game is rival countries are secretly collaborating, so we secretly have world peace!

Re: Social engineering takeovers of open source projects

#198

Post by guappa »

PartiallyTyped wrote: post #15
andix wrote: post #13

Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases. In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent…

> Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. The rust project does it. There's a repo with all [active] members and their permissions on github, etc. These get synchronized and updated every time there's a change.

The major projects aren't on github.

Re: Social engineering takeovers of open source projects

#199

Post by csomar »

ilhuadjkv wrote: post #65

Would it be interesting if Github (and others) had a program where they would verify people using the same regulations the banking industry uses for KYC (know your customer)? Optional step for developers to show they are who they say they are?

No. Let's stop having these ideas of a totalitarian world. Instead, find solutions for zero-trust environments.

Re: Social engineering takeovers of open source projects

#200

Post by glodalitazic »

voiper1 wrote: post #197
transpute wrote: post #186

Earlier quoted context omitted.

At least 2 rival legal Jurisdictions/Alliances/Spheres At least 2 rival state intelligence Agencies per Sphere At least 2 rival corporations per Sphere TOTAL: 2*(2+2) = 8 Widely used OSS projects are contested spheres of collaboration.

So the long game is rival countries are secretly collaborating, so we secretly have world peace!

Imagine all war stops and noone knows it
Post reply on HN