5 ms·
“Additionally, due to the open nature of most SCM systems today, much of the source code it is built to protect can be copied and managed on the endpoint develo
by bruceboughton 17y ago
“Additionally, due to the open nature of most SCM systems today, much of the source code it is built
to protect can be copied and managed on the endpoint developer system,” the paper states. “It is quite common to have developers copy source code files to their local systems, edit them locally, and then check them back into the source code tree. . . . As a result, attackers often don’t even need to target and hack the backend SCM systems; they can simply target the individual developer systems to harvest large amounts of source code rather quickly.”
---
Forgive me but isn't this the function of a SCM? What other models are there?
- roc 17y agoLocking down individual developers to only the source they absolutely need. In that model, a single compromised workstation would only expose a few modules to malicious changes and only a few projects to code theft. In the more-common wide-open implementation, a single compromised workstation exposes the entirety of code for every project to theft and malicious changes. When you're talking about an under-the-radar hack that took place over months, hackers intentionally slipping vulnerabilities into the code is a very real risk.
- bruceboughton 17y agoAnd you can surely do this with most SCMs on the market, including Perforce. Now all the hacker needs to do is compromise the build server...
- joe_the_user 17y agoThere is often a divide between developer needs and security. A desktop developer wants their machine to run as quickly as possible to allow them to compile and run quickly. This may tempt them to turn off virus checking. A challenge in security is making work without being too onerous. If security measures become a hassle for users, they'll find a way around them.