251–260 of 379 posts
Earlier quoted context omitted.
Web of trust, but all commits must be signed by at least 3 intelligence agencies from rival countries.
Russia, China, Iran and NK cock-block development for years, because the MR “doesn’t represent their interests”.
Earlier quoted context omitted.
US gov has encouraged finance/tech industry to invest in the security of OSS supply chains. OpenSSF members: https://openssf.org/about/members 2021, $10MM, https://openssf.org/press-release/2021/10/13/open-source-sec... > Financial commitments from Premier members include Amazon, Cisco, Dell Technologies, Ericsson, Facebook, Fidelity, GitHub, Google, IBM, Intel, JPMorgan Chase, Microsoft, Morgan Stanley, Oracle, Red…
Why did Eclipse org get so much and Apache org none/less? In my experience, the footprint of Apache exceeds anything else in enterprise programming.
So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D
A kind of similar thing happened with game key scammers. People will email the devs of hundreds of Steam games pretending to be a popular YouTuber, asking for keys for themselves and usually a few extra "for a giveaway". If they get the keys, they'll try to resell them for a profit. At first you'd get emails from like, pewdiepie@outlook.com instead of pewdiepie@gmail.com. But you could usually check the YouTube about…
Earlier quoted context omitted.
They might not even use blackmail, they might just "help out" in a difficult financial situation. Some people are in severe debt, have a gambling problem, are addicted to expensive drugs, or might need a lot of money for a sick relative. There are many possibilities. The trick is finding the people that can be compromised.
I think you're going overboard on what's required. Take anybody who is simultaneously offered a substantial monetary incentive (let's say 4 years of total current/vesting comp), and also threatened with the release of something that we'll say is little more than moderately embarrassing. And this dev is being asked to do something that stands basically 0 risks of consequences/exposure for himself due to plausible deni…
Earlier quoted context omitted.
I think he was making a tounge in cheek point about how we could finally get extremely well-founded open source projects.
I did not referred to the funding remark. It is besides the point and immaterial to the discussion. My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and ha…
Anyone who has played Eve Online is familiar with this process. Gain membership, become a valued contributor to the corp, then betray it for profit.
If anyone has a few hours free, I'd recommend this documentary about Eve Online - https://www.youtube.com/watch?v=BCSeISYcoyI
It's a shame because I presume if it's recommended despite that it must be insightful.
I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"
I’m in it for a free t-shirt.
I think scamming, in general, should be taught early on in schools, as well as finances.
Earlier quoted context omitted.
I'm sure some security researcher is doing this, but we could easily create a visualization of "who has contributed over time" and identify transitioning of maintainers automatically just from git. This might be worth doing and contributing to a site like bestofjs or libraries.io (I don't really use that one though!)
> who has contributed over time When major security players insist that using GPG is bad, there is no way of knowing if bob@bob.bob is the same account that it was last month or not.
Can we, PLEASE, return back to batteries-included first? While it doesn’t eliminate the threat completely, but I can sleep soundly knowing that I need to vet one party instead of 1000.
+1. My team still favors batteries-included style systems, even if it means missing out on the latest thing all the cool kids on the internet are talking about. For languages, this usually means sticking with the standard library that ships with it along with one or two libraries that augment it (e.g., BOOST for C++). It's not like "batteries included" eliminates the problem - a bad actor can wander in there and caus…