I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"
Social engineering takeovers of open source projects
321–330 of 379 posts
Re: Social engineering takeovers of open source projects
#322Re: Social engineering takeovers of open source projects
#323Re: Social engineering takeovers of open source projects
#324I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"
Honestly, a good PR should have a very clear description of the idea and a sample implementation, and then a trusted core contributor re-implements the fix on his own. But Github users are entitled and spoiled by Github-marketed commercial software, so they will rage at this.
Re: Social engineering takeovers of open source projects
#325Earlier quoted context omitted.
Your choice of language in your comments (in this thread, not in general) isn’t bolstering your argument. Why not be curious rather than just dismissive? This seems to be people just talking past each other at this point. There have been a lot of changes in the last ~five years that point in the direction of supply chain security being at greater risk. Evidence comes in many forms. The relevance of evidence depends o…
> Your choice of language in your comments (in this thread, not in general) isn’t bolstering your argument. Yeah, you're probably not wrong. I've had this argument a few times now, and it's the same dismissive "we don't know what we don't know" every time. Well, you can say that for everything and given the complexities of the xz attack that seems a bit unlikely to me, which is then again countered with "but we don't…
> "Every contributor is dangerous" is spectacularly toxic type of attitude.
I view this from the lens of "How well can people reason about probabilities?" and research has shown, more or less, "not very well". In the short term, therefore, it is wise to tailor communications so as to avoid predictable irrational reactions. In the medium term, we need to _show_ people how to think about these questions rationally, meaning probabilistically.
For what it is worth, I prefer to avoid using the phrase "common sense", as it invites so many failure modes of thinking.
My current attitude is, more or less, "let's put aside generalizations and start talking about probabilities and threat models". This will give us a model that makes _probabilistic predictions_. Models, done well, serve as concrete artifacts we can critique and improve _together_.
I hope to see some responses to my other comment at https://news.ycombinator.com/item?id=40271146 but I admit it takes more effort to share a model. It is well outside the usual interaction pattern here on HN to make a comment with a testable prediction, much less a model for them! Happily, there are online fora that support such norms and expectations, such as LessWrong. But I haven't given up hope on HN, as it seems like many people have the mindset. I think the social interaction pattern here squanders a lot of that individual intelligence, unfortunately... but that pattern can change in a bottom-up fashion as people (more or less) demand, at the very least, clearer explanations.
Re: Social engineering takeovers of open source projects
#326Earlier quoted context omitted.
> Compromising people is the core competency of intelligence, happens all the time, and most cases probably never come to public knowledge. Yea. It would almost be strange if security service didnt consider the route of getting "kompromat" on a developer to make them "help" them.
I’m reading all this with sadness realizing that one of the Internet’s last remaining high trust spaces is being destroyed.
One of the Internet's last remaining high trust spaces is being attacked.
What happens next is still unwritten.
Re: Social engineering takeovers of open source projects
#327Earlier quoted context omitted.
> Compromising people is the core competency of intelligence, happens all the time, and most cases probably never come to public knowledge. Yea. It would almost be strange if security service didnt consider the route of getting "kompromat" on a developer to make them "help" them.
They would be really bad at their job, if they didn't try.
Re: Social engineering takeovers of open source projects
#328Earlier quoted context omitted.
Your choice of language in your comments (in this thread, not in general) isn’t bolstering your argument. Why not be curious rather than just dismissive? This seems to be people just talking past each other at this point. There have been a lot of changes in the last ~five years that point in the direction of supply chain security being at greater risk. Evidence comes in many forms. The relevance of evidence depends o…
> Your choice of language in your comments (in this thread, not in general) isn’t bolstering your argument. Yeah, you're probably not wrong. I've had this argument a few times now, and it's the same dismissive "we don't know what we don't know" every time. Well, you can say that for everything and given the complexities of the xz attack that seems a bit unlikely to me, which is then again countered with "but we don't…
I'm not quite following the second sentence. What kind of community have you worked for? Do you mean "worked for" as in e.g. "the spirit of your comments on HN"? Or something else?
Re: Social engineering takeovers of open source projects
#329Re: Social engineering takeovers of open source projects
#330Earlier quoted context omitted.
On first reading your comment makes a lot of sense, and is certainly logical for maximizing the common good. But unfortunately, companies simply don't work the way you are proposing. The short reason is this "good citizenship is indistinguishable from corruption. Therefore good company governance leans away from both." The somewhat longer answer is that while a "company" might have a lot of money, or might make a lot…
"What companies pay for" is anything they cannot get for free. If the value of an OSS project is mostly in its code, then any license that allows it to be used commercially will mean lots of free-riding.
If companies want better guarantees, then they should contribute more.