Social engineering takeovers of open source projects • Hacker News Board

Re: Social engineering takeovers of open source projects

#301

Post by newswasboring » Mon, May 06, 2024, 11:39 AM UTC

bruce511 wrote: post #169

armini wrote: post #163

Earlier quoted context omitted.

I've been working on thanks.dev for over two years now & reading this report is disappointing to say the least. Why not spend the time to explain the value XZ Utils created for all the commercial users & what companies can do to better supporting maintainers with hundreds of issues experiencing burnout from their unpaid work? OpenSSF should instead promote FOSS programs like https://frontendmasters.com/blog/how-were-…

On first reading your comment makes a lot of sense, and is certainly logical for maximizing the common good. But unfortunately, companies simply don't work the way you are proposing. The short reason is this "good citizenship is indistinguishable from corruption. Therefore good company governance leans away from both." The somewhat longer answer is that while a "company" might have a lot of money, or might make a lot…

I'm sorry but this is a huge copout. At least the big companies and governments have the money to solve all these problems. They have literally teams of lawyers on retainer and they can hire a few more people for all the other self created bureaucracy. None of the things mentioned here are laws, of nature or otherwise.

Re: Social engineering takeovers of open source projects

#302

Post by d0mine » Mon, May 06, 2024, 11:39 AM UTC

willvarfar wrote: post #168

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D

Or even better: push a cryptographic protocol with a builtin weakness as a standard and deprecate others as "insecure."

Any implementation would be vulnerable.

Re: Social engineering takeovers of open source projects

#303

Post by em-bee » Mon, May 06, 2024, 11:42 AM UTC

johnnyanmac wrote: post #167

em-bee wrote: post #69

Earlier quoted context omitted.

gee, people can't take a bit of humor to make a point?

HN has traditionally been a bit more resistant to humor, even slightly more witty humor.

yeah, that's why from time to time i like to resist back a little. there is room for the occasional witty response to lighten up the mood

Re: Social engineering takeovers of open source projects

#304

Post by urduntupu » Mon, May 06, 2024, 11:43 AM UTC

"Good" that Microsoft now owns GitHub. They could now provide their AI tech to find out (and sell) which social engineering methods have worked out successfully on open source GitHub projects. I.e. which socially engineered PRs had been accepted and which not. And then train their models to improve PR acceptance right. Allowing to automate or at least enhance the entire project communication for best acceptance rate. #NSAKEY

Re: Social engineering takeovers of open source projects

#305

Post by flumpcakes » Mon, May 06, 2024, 11:50 AM UTC

Nition wrote: post #248

willvarfar wrote: post #168

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D

A kind of similar thing happened with game key scammers. People will email the devs of hundreds of Steam games pretending to be a popular YouTuber, asking for keys for themselves and usually a few extra "for a giveaway". If they get the keys, they'll try to resell them for a profit. At first you'd get emails from like, pewdiepie@outlook.com instead of pewdiepie@gmail.com. But you could usually check the YouTube about…

How do you know those two channels are "fake" or "scammers"?

I think I have a good eye for these things and worryingly they just look like the normal low effort youtube chaff but I wouldn't have thought fake/scamming.

Re: Social engineering takeovers of open source projects

#306

Post by em-bee » Mon, May 06, 2024, 11:51 AM UTC

guappa wrote: post #225

em-bee wrote: post #52

Earlier quoted context omitted.

yes and no. i hate 2FA as well, but in the end, even if i loose my access to github i only loose access to my github identity but i don't loose access to my code, so i can live with that. of course in the light of this discussion losing access to my github identity would be part of the problem, so it's a tradeoff. is it more likely that someone will break into my account and abuse my identity if i don't have 2FA or i…

> if i loose my access to github i only loose access to my github identity but i don't loose access to my code, so i can live with that. That means that you need to fork your own project, and there is no way to communicate it to the users, since the new account could just be someone pretending to be you. If there is a security vulnerability, it would remain unfixed forever. > is it more likely that someone will break…

well, yes, exactly. once i realized that, my reaction was: why thank you github, you just made my one factor auth more complicated for little gain. well, ok, i don't store the otp with the password, so cracking the password became a bit more complicated too. but for example committing code doesn't require otp and my browser has me permanently logged in, so where exactly is the added safety now?

as for the lost identity. a new user could at least share a warning. that user doesn't have to be trusted to get others to be more vigilant and scrutinize the code very carefully as eg was done with XZ once the issue was discovered. imagine an unknown user would have alerted the community that the maintainer account was compromised or locked out. they could have reached out to people who know them to verify their identity and to corroborate the claim. it would be a long and tedious process, but at least any attacker would be prevented from getting any further advantage too.

it could still mean loss off the maintainership and loss of users, but i can also host my projects in multiple places so that only part of my known and verifiable identity can get compromised at once.

in the end it's partly security theater, partly arms race, partly an improvement through raised awareness...

Re: Social engineering takeovers of open source projects

#307

Post by kibwen » Mon, May 06, 2024, 11:52 AM UTC

williamdclt wrote: post #244

greatgib wrote: post #121

First I think that it is wrong to single out this issue on Open Source projects. For example, since the first versions of app stores, when you are an app developer you would receive a lot of messages from random shady dudes ready to buy your application if it had a few users. Also, the xz thing was kind of pretty smart, but it is also a thing in mind of most OSs developers that you can't trust any random contributor…

The scope of impact if a mobile app becomes malicious is _immensely_ smaller than if xz becomes malicious. The latter seems to be national security level

Only because most people aren't using mobile apps for real work. But if someone were using a mobile app to perform SSH and the app is backdoored, it's game over for any server you SSH into.

Re: Social engineering takeovers of open source projects

#308

Post by whatevaa » Mon, May 06, 2024, 11:54 AM UTC

KronisLV wrote: post #271

samatman wrote: post #64

Earlier quoted context omitted.

> Not on any third party system, where you're locked out forever if you lose your second factor. Every two-factor system I've ever seen is actually two-of-three, with an account recovery code that you save elsewhere. I lost all my two-factor auths when my phone got wrecked, it was annoying to reestablish access to those accounts (and I now use a TOTP client which backs the tokesn up), but it was tedious rather than d…

> and I now use a TOTP client which backs the tokens up What are some good options for this? I think my ideal solution would export an encrypted file, a bit like KeePass does on the desktop, but I don't know of many mobile apps for that.

andOTP on Android does encrypted backups. I once recovered by loading a backup in android emulator :)

Re: Social engineering takeovers of open source projects

#309

Post by KronisLV » Mon, May 06, 2024, 12:02 PM UTC

whatevaa wrote: post #308

KronisLV wrote: post #271

Earlier quoted context omitted.

> and I now use a TOTP client which backs the tokens up What are some good options for this? I think my ideal solution would export an encrypted file, a bit like KeePass does on the desktop, but I don't know of many mobile apps for that.

andOTP on Android does encrypted backups. I once recovered by loading a backup in android emulator :)

Thanks! That one looks cool, but apparently is unmaintained: https://github.com/andOTP/andOTP

Re: Social engineering takeovers of open source projects

#310

Post by transpute » Mon, May 06, 2024, 12:02 PM UTC

sim7c00 wrote: post #288

transpute wrote: post #126

Earlier quoted context omitted.

> it should be easier to write systems from scratch, rather than to have to use third party code for everything. computers currently are not condusive to this. they need to be built different, to allow software to be built different. Yes. We also need to encourage user scripting of first party library APIs on devices. iOS Shortcuts are a step in the right direction, but they need better tooling to maintain and distri…

theres definitely improvements ofcourse. apple is not wrong trying to have more of the chain as a single vendor. i would hope amd/intel and such places might offer more help also to implement their devices easily. (implementing amd64 is really difficult imho, only acpi has some good code from the vendor and thats such a small part of whats needed). we know kot to build a house on a bad foundation, but somehow built o…

> we know not to build a house on a bad foundation, but somehow built our techstack on a flimsy one

Good analogy. Extending it further, homebuilders have liability and regulation for safety, while software has been a contest of incentives for creation, extraction and influence. With the convergence of "cyber" and physical reality, liability is coming to software development.

Alan Kay's VPRI has a few papers on new approaches to software, https://tinlizzie.org/IA/index.php/Papers_from_Viewpoints_Re...

https://tinlizzie.org/VPRIPapers/M2013004_agere.pdf

  The software for today’s personal computing environments has become so complex that no single person can understand an entire system. Our group’s early experiences with personal computing led us to understand that the essential model of personal computing can be expressed much more compactly. Our group engaged in.. the STEPS project) to materialize that vision over the last six years.. There are various meta-language implementations. A new stream-processing language called Nile was invented. The syntax of Nile allows a fully-featured vector graphics engine.. to be written in a clean, mathematical manner in less than 500 lines of code. 

 .. Another direction is to take the idea of loose-coupling to the next level; objects should not know about other objects directly but should always negotiate and “find” other objects.. J.C.R. Licklider already foresaw the need for program components to discover each other on a huge network of computers. From that viewpoint, what we are trying to do is to carry the vision forward.