Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

181–187 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#181

Post by silverliver »

zoover2020 wrote: post #102
efortis wrote: post #55

Earlier quoted context omitted.

Correct, the above mitigation is only for malware on the dev laptops and build servers. IOW, it doesn't prevent injecting the malware on your program when compiling it.

Shouldn't build servers have limited or zero network connectivity in the first place?

Modern languages make offline builds far more difficult then they have to be, unfortunately. Rust, for example, buries its off-line installer on another domain. Rust also doesn't advertise or encourage bundling dependencies. Lastly, unrestricted build scripts basically give every dependency full code execution.

Re: Over 100k Infected Repos Found on GitHub

#182

Post by silverliver »

pas wrote: post #168
remram wrote: post #127

Earlier quoted context omitted.

Any equivalent for non-Rust projects? I see git-crev is abandoned...

unfortunately the Rust version seems abandoned too :(

Unfortunate but expected. You get tired after swimming against the current for so long. The rust community has for better or worse settled on wild unauditable dependency graphs. A real shame given how delightful the base language is (ignoring async, of course).

Most people who can't deal with this, including myself, simply switched to other languages.

Re: Over 100k Infected Repos Found on GitHub

#183

Post by Lt_Riza_Hawkeye »

gitaarik wrote: post #180
lb4r wrote: post #91

Earlier quoted context omitted.

Wouldn't it be easier (since they probably have very skilled programmers working for them) and way, way more effective to just set up a team and create a quality open source project with one or two extremely stealthy backdoors? Or just pay or threaten a struggling company or dev to insert them?

How would you secretly hide something like that in FOSS? And why would that be easier? It's seems to me that it's easier to inject into an existing company than to do all the work yourself. This is what they do with most things as I understand.

The heartbleed vulnerability was hidden in plain sight for the better part of a decade, no?

Re: Over 100k Infected Repos Found on GitHub

#184

Post by gitaarik »

Lt_Riza_Hawkeye wrote: post #183
gitaarik wrote: post #180

Earlier quoted context omitted.

How would you secretly hide something like that in FOSS? And why would that be easier? It's seems to me that it's easier to inject into an existing company than to do all the work yourself. This is what they do with most things as I understand.

The heartbleed vulnerability was hidden in plain sight for the better part of a decade, no?

Yes, but that was a memory leak, giving access to unauthorized random memory. That is not an intentionally created exploit / backdoor which gives the owner easy access to the victim's system.

Re: Over 100k Infected Repos Found on GitHub

#186

Post by pas »

silverliver wrote: post #182
pas wrote: post #168

Earlier quoted context omitted.

unfortunately the Rust version seems abandoned too :(

Unfortunate but expected. You get tired after swimming against the current for so long. The rust community has for better or worse settled on wild unauditable dependency graphs. A real shame given how delightful the base language is (ignoring async, of course). Most people who can't deal with this, including myself, simply switched to other languages.

can you please elaborate on which language(s) you switched to?

Re: Over 100k Infected Repos Found on GitHub

#187

Post by silverliver »

pas wrote: post #186
silverliver wrote: post #182

Earlier quoted context omitted.

Unfortunate but expected. You get tired after swimming against the current for so long. The rust community has for better or worse settled on wild unauditable dependency graphs. A real shame given how delightful the base language is (ignoring async, of course). Most people who can't deal with this, including myself, simply switched to other languages.

can you please elaborate on which language(s) you switched to?

Perhaps an over-correction, but I've switched to Go.

Any language with a proper standard library would do, but I found Go's modern and useful standard library to be well-worth the inefficiency and clunkyness of that language.

The more expansive the standard library is, the better.

Post reply on HN