Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A cautionary tale about software dependencies during major geopolitical events

blog.benjaminvr.net

Post reply on HN
Print view View original

21–30 of 41 posts

Re: A cautionary tale about software dependencies during major geopolitical events

#21

Post by betaby »

bruce511 wrote: post #9

I'm not sure the article really makes the point, but in my experience the war has complicated remote work. I'm tangentially aware of at least one US company that was outsourcing work to Russian and Ukrainian coders. Apart from the obvious "team" dynamics collapsing, it's not even possible (legal) to pay Russians at this point if you are a US company. I'm also aware that the narrative inside Russia as to the cause of…

> it's not even possible (legal) to pay Russians at this point if you are a US company.

Unless you are buying oil, diamonds and many other things through NATO allies or proxy companies registered. But I agree, rules for thee but not for me.

https://www.washingtonpost.com/business/2023/11/14/russian-o...

Re: A cautionary tale about software dependencies during major geopolitical events

#23

Post by bragr »

_5hxt wrote: post #20
lupusreal wrote: post #15

Earlier quoted context omitted.

Given that this is the internet and I don't know you, how can I distinguish a sane person making well founded claims backed by hidden evidence they won't share with me, and a crazy person just being paranoid and seeing conspiracy where there is none? Usually the evidence is what makes the difference, but if you can't/won't share the evidence then what good are the accusations?

That's fair, shall I put the names in the article and a link to the repository? Really, it's a war. Do you think I will risk my own wellbeing just to have clout for a few days? Not to mention opening myself up for the possibility of being sued by one or more contributors for "slander". I chose this approach and won't budge on that - it's not a fairy tale that people are dying and everything is affected by it, the lis…

Considering you have Mantine forked on your linked GitHub, you aren't going to great lengths to hide who you are directing this at, so to me it appears like slander.

Re: A cautionary tale about software dependencies during major geopolitical events

#24

Post by dontupvoteme »

xmprt wrote: post #10
bradyd wrote: post #3

I don't really see how this has anything to do with major geopolitical events, other than the fact that the developer of the library is Russian. The author's complaints could have happened with any open source library and don't seem to relate to the war in Ukraine in any way.

To give a more realistic answer to this question, when I was writing an article about npm dependencies[1], I incidentally came upon a case where the developer of node-ipc released a malicious version of the package that affected computers in Russian and Belarusian IPs specifically in response to the Ukraine war[2]. [1]: https://www.preethamrn.com/posts/who-actually-uses-is-odd [2]: https://www.bleepingcomputer.com/ne…

I forgot about that targeted malware for a while, thanks for jogging my memory.

Imagine now if he had done that towards Israelis or Arabs/Palestinians and how both the internet and governments would react.

He only got away with such blatant crime because the entire west was against Russia. Mad that the overton window went so wide for a while there.

Re: A cautionary tale about software dependencies during major geopolitical events

#25

Post by goga-piven »

Many underestimate how many resources Russia puts into cyber warfare, and how simple dependencies or Docker images can be infected with malicious intent. Authors often have no choice but to do what they are told if they are physically located in Russia. Western folks, having never lived in such an environment, simply have no idea how things are different.

Are there not enough examples already proving the state of things in the industry right now? All the points the author mentioned are valid, in my opinion. Even if in this particular case it may not be true, there is a large background suggesting why it could be true.

Re: A cautionary tale about software dependencies during major geopolitical events

#27

Post by kgeist »

From my experience as a developer from Russia, it's usually the other way around from what's found in the article. Since 2022, there's been a lot of instances of malware being found in dependencies which target Russian developers (deleting data in prod, denial of service). Many sites which host tutorials, programming blogs etc. have become unavailable to Russian devs ("access from your country is blocked"). Some repos removed Russian localizations altogether. Github deleted repos and banned accounts of developers with links to Russian banks and other large companies (even if they don't work there anymore). In the last year, our corporate site was defaced and DDoSed several times from foreign IPs.

I don't know about others, but I have't witnessed some kind of similar refusal by Russian devs to cooperate with Western devs, not there's been any protests in the form of altering repos.

What really changed in Russian IT after the war started is that 1) it strenghtened Russia's infosec - for example, our company finally started reviewing random dependencies developers found on the Internet before going to production 2) some companies went into "hiding" and changed their legal names, "moved" their offices abroad, changed country info in GitHub profiles etc., to avoid being associated with Russia because it's now problematic if you want to deal with Western companies/devs (refusal to work with). As for not receiving donations etc. - it's not easy to set up because of sanctions.

Re: A cautionary tale about software dependencies during major geopolitical events

#28

Post by ashishbijlani »

seeknotfind wrote: post #18
_5hxt wrote: post #7

Earlier quoted context omitted.

Thanks for your comments. I have to admit that it is shallow - going in more detail would risk identification of the people involved and paint a target on my back. I do realize that he may have simply changed his opinion - yet it is the most controversial one and he stood by it ideologically as expressed numerous times through a variety of mediums. It's a bit tinfoil hat, but I am disappointed and there's no harm in…

As someone off this thread, lol, I hope you have a great weekend too. Whether it happened or not, it's a reminder of what can happen. Better to learn from mistakes you haven't suffered from so deeply yet. For starters, when in doubt, it doesn't hurt to get rid of the software dependencies you don't need. For how to know you can trust a dependency, I'm afraid there is no solution: no theorem prover nor isolation, cryp…

> For how to know you can trust a dependency, I'm afraid there is no solution: no theorem prover nor isolation, cryptography nor layerizarion can save you.

I'm taking a stab at addressing this problem with Packj [1]. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more.

1. https://github.com/ossillate-inc/packj

Re: A cautionary tale about software dependencies during major geopolitical events

#29

Post by lcedp »

I have trouble discerning the author's point exactly.

- Yes, you can't rely on open-source project going in the same direction as you want.

- Yes, any process involving people has a phycological and interpersonal component.

> To this day we read about the war and it feels distant[...]

> [..]don't get blindsided, especially in times of war[...]

I'm glad the author is not affected by the war, but I supposed it's fair to say that it is not hard for the author to stay unbiased (or it might be just indifferent).

Re: A cautionary tale about software dependencies during major geopolitical events

#30

Post by _5hxt »

lcedp wrote: post #29

I have trouble discerning the author's point exactly. - Yes, you can't rely on open-source project going in the same direction as you want. - Yes, any process involving people has a phycological and interpersonal component. > To this day we read about the war and it feels distant[...] > [..]don't get blindsided, especially in times of war[...] I'm glad the author is not affected by the war, but I supposed it's fair t…

My point would mainly be to spread awareness and share an experience and my interpretation of it, not "slander" and paint a target on my back by namecalling and divulging more information which doesn't serve a purpose beyond wanting clout under the assumption that the war does not affect myself and others around me.

Thanks for reading. Have a good weekend.

Post reply on HN