Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering takeovers of open source projects

openssf.org

Post reply on HN
Print view View original

21–30 of 379 posts

Re: Social engineering takeovers of open source projects

#21

Post by sim7c00 »

i dont think maintainer changes is even the endgame for this stuff. its hard to get a new person in, but a nation state can likely more trivially attack a current maintainer.. everyone has a button somewhere. the only solution to this is tooling which can flawlessly reason about code changes being malicious or not, being applied to every change in a project. and then still its a lost cause. a lot of issues and vilnerabilities come from how softwarw interoperates witj other software. will you be able to reason about all possible package combinations and how they are secure or not when they come together in certain ways?

it should be easier to write systems from scratch, rather than to have to use third party code for everything. computers currently are not condusive to this. they need to be built different, to allow software to be built different.

maybe while we are at it we can also make it so computers reduce complexity in peoples lives instead of adding to it.

Re: Social engineering takeovers of open source projects

#22

Post by bsuvc »

I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs.

I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"

Re: Social engineering takeovers of open source projects

#23

Post by janosdebugs »

michelsedgh wrote: post #9

Well after the XZ attack, I was thinking how common this can be. Good to know that at least im not the only one and others inside the community are wondering about this. I hope someone is smart or lucky enough to find a solution to at least be able to lessen the impact of these attacks. I still wonder how many more of these are there, and my question is because of these attacks, isn’t open source more prone to these…

The problem is, we don't know. I've seen PRs that could be curious students, or it could be a first try to see if we are paying attention. It's really easy these days to produce a halfway decent looking PR for someone in their first year of uni and my worry is that an increased volume of low to medium quality contributions will lead to maintainer fatigue. Depending on the project, that may be the point where pressure can be applied to share maintainership.

Re: Social engineering takeovers of open source projects

#24

Post by smsm42 »

piecerough wrote: post #16

This is only going to get worse with Large Language Models. Let's imagine a somewhat knowledgeable individual, could craft both emails, messages and even commits with a bunch of prompts. Those will relate deeply to the project.

Maybe one day it will happen, but right now LLM-generated persona would likely set off every alarm bell for a lot of people. LLMs have very recognizable style, and it usually falls right into the uncanny valley.

Re: Social engineering takeovers of open source projects

#25

Post by imachine1980_ »

zer00eyz wrote: post #11
dvh wrote: post #5

We've been adding features for 30+ years to open source software, they become so complex only very few people understand them anymore. Recently I looked into jfet level 2 implementation in ngspice, expecting familiar equations, but through series of small changes and maybe some DRY too, the code is almost unrecognizable. When graybeards finally retire, there will be lots of shrugs.

Your average American could quit working for 5 million dollars. They could live comfortably for the rest of their lives off that money, if well invested (read EFT for sp500) 5 million bucks is change for you average government. "Amazon made billions on my project and if I turn a blind eye to this I can retire, fuck them..." Sponsorship, for good or bad makes a lot of decisions simple.

[flagged]

Re: Social engineering takeovers of open source projects

#28

Post by andy99 »

bsuvc wrote: post #22

I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"

It's not the new contributors you have to watch, it's the sleeper contributor who has built up a solid reputation and then is "activated". At least that's how I understand XZ.

Re: Social engineering takeovers of open source projects

#29

Post by Uehreka »

andy99 wrote: post #28
bsuvc wrote: post #22

I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"

It's not the new contributors you have to watch, it's the sleeper contributor who has built up a solid reputation and then is "activated". At least that's how I understand XZ.

It’s both. The fact that one happened recently does not preclude the other.
Post reply on HN