9 ms·
This is a wake up call. Too many things are relying on Github right now. Microsoft was part of the PRISM program. If Microsoft shares SSL certs with NSA they c
by sanbor 8y ago
This is a wake up call. Too many things are relying on Github right now.
Microsoft was part of the PRISM program. If Microsoft shares SSL certs with NSA they could do MITM attacks. What if in some very specific cases you download dependencies from GitHub and they give you a different version with malicious code?
It's the NSA. They could be smart enough to only deploy those attacks on production servers were nobody is going to manually review npm packages.
- dschuetz 8y agoYes! The Internet is a giganto conspiracy theory! No, you're wrong, it's the CIA! They asked DARPA to develop ARPA net, remember?
- kibwen 8y agoWhy would Github be any harder for the NSA to coerce than Microsoft?
- falcon620 8y agoBecause Github, unlike Microsoft is not particularly dependant on US government contracts.
- lwansbrough 8y agoNSA doesn't have to ask, so this is a moot point.
- anonymouswacker 8y agoExactly. This is why there's no point in encryption, or any sort of obfuscation.
- xaiki 8y agoWell hello there, I'd like to share a story with you. I'm the maintainer of butterproject.org and have been maintaining popcorntime.io for a while, we had there 2 issues with GitHub a few years ago, both related to (unfounded) copyright claims on the butter and popcorntime code (we absolutely own the right to every single line there), when we tried to make our case we were ignored once and asked to 'keep things quiet' by side channels the second time. Most likely, the mpaa, didn't want us to exist and GitHub complied with shutting down our repos and sending a cese and desist to all our 800ish forks (at a time where we were trying to transform BitTorrent media streaming into a viable business plan). Maybe it's time we build our core infrastructure on something else than companies that act irrationally when threatened to be sued ?
- rckclmbr 8y agopopcorntime was strictly confrontational, and was blatantly illegal. "Transforming BitTorrent media streaming" can be a good goal, but doing it illegally will cause you to be shut down. Remember grooveshark? They tried the same thing -- to create a legit service that disrupts and industry. But there's a reason they failed and spotify succeeded, and I think it's because they partnered with existing companies instead of tried to act in direct opposition.
- walterstucco 8y agoI'm more inclined to think that Spotify succeeded because it's based in Sweden
- jacquesm 8y agoBut their source code wasn't illegal.
- deleted 8y ago[deleted]
- sushisource 8y agoThey could also do it regardless of whether or not Microsoft owns them or whatever favorite acronym authorizes them, or whatever. I've never understood why people love freaking out about this stuff. If the NSA felt like spying on you, pro tip, they're gonna be able to do it. If you care about keeping your shit secure, it shouldn't be on the internet at all.
- Kenji 8y agoWell at least we can make it a little difficult on them, can't we? I love presenting others a challenge!
- amelius 8y ago> If the NSA felt like spying on you, pro tip, they're gonna be able to do it. True, but I suppose it matters how easy/difficult it is for them to do that.
- cdelsolar 8y agoThe NSA is not god, they can't break 2048-bit TLS encryption no matter how many computers they have.
- partycoder 8y agoThere's theory, design and implementation. Maybe in theory it is safe, but implementations are often not safe. An oversimplified way to see this is that your software runs on an OS which runs on a processor. Your processor is backdoored (Intel ME and equivalent), your OS is backdoored, the entropy for your crypto is backdoored (Intel RDRAND instruction), your crypto algorithm implementation is backdoored. So there are infinite resources for them to hack you at any moment for any reason. You have already gave them the keys to everything.
- 2trill2spill 8y ago> The NSA is not god, they can't break 2048-bit TLS encryption no matter how many computers they have. 2048 bit TLS encryption? You mean 2048 bit RSA encryption? Also what source do you have that says the NSA can not crack a 2048 bit RSA key? Last I checked that info was non public and there is no definitive, credible source saying whether they can or can not crack 2048 RSA keys.
- merinowool 8y agoThey now have access to private projects so can use that to help create exploits to closed source products that are hosted on GitHub or use it to create their own products or patents.
- Fnoord 8y agoWho has this access. The NSA? They didn't have this access when GitHub was independent? Says who? Backed up by which facts?
- merinowool 8y agoFact is Microsoft is a hostile company and will have access to private repositories.
- Fnoord 8y agoFact? How do you define whether Microsoft is hostile? What are your criteria? Look, I hated Microsoft in the '90s and '00s. I was there. I grew up in a world where IBM dominated the market though. They've both changed. The market has changed and both of these companies had to deal with that. The reality is that nowadays people pay with their privacy instead of with currency for a product; they are the product. Does it matter much who owns the product (independent US company, big player like Amazon, Microsoft, Facebook, Amazon, or Apple?)
- merinowool 8y agoMy criteria is based on how they treated me on several occasions.
- Fnoord 8y agoVery vague description of your anecdotal evidence. I mean, for starters, which time period are you referring to?
- trgv 8y agoWhenever I read these kinds of posts on this website I think of Sterling Hayden in Dr. Strangelove. (The crazy SAC commander who thinks the Russians are plotting to steal Americans' precious bodily fluids). I understand that people don't trust the NSA/US government. And they shouldn't: the US government will always put its interests above yours and mine, and above those of allied countries. At the same time, this stuff is bordering on parody. Very few of us (maybe none of us) need to worry about "the NSA MITM-ing our NPM packages". If you're that paranoid then you shouldn't be using github, NPM, or non-local dependencies. And of course you should be reviewing everything manually.
- himom 8y agoThat’s why I only drink rainwater and pure grain alcohol. Purity Of Essence.
- eanzenberg 8y agoI personally am not worried. If I was running some nuclear centrifuge in Iran/N.Korea/etc. then I'd be worried.
- passivepinetree 8y agoThis is another phrasing of the worn-out "If you have nothing to hide, you have nothing to fear" argument, and it doesn't have any place here.
- eanzenberg 8y agoSure if I am the moral equivalent of an authoritative gov't seeking nuclear arms.
- sanbor 8y agoI didn't mean that this is going to happen. I wanted to give an example of a potential threat. My idea was to show one of many problems with centralization and relying so much in GitHub and GitHub SSL certs. Maybe we can start signing our commits to increase security giving the potential threat. The same way that after the Snowden revelations we started using more and more HTTPS. We can also think of better ways of sharing/releasing open source code. Debian has a pretty neat system with keys so it's pretty safe to install software from their repos [1]. Maybe there is a better system to be develop than just grabbing whatever from GitHub[2] and running it in your machine. [1] https://en.wikipedia.org/wiki/Debian#Development_procedures https://en.wikipedia.org/wiki/Debian#Development_procedures [2] https://github.com/mklement0/n-install/blob/master/bin/n-install#L27 https://github.com/mklement0/n-install/blob/master/bin/n-ins...
- lern_too_spel 8y ago> If Microsoft shares SSL certs with NSA they could do MITM attacks. There is zero reason to believe they do.
- binaryblitz 8y agoand the NSA wasn't spying on American citizens. Oh. Wait.
- dorkusmcgavin 8y agoYour intention is correct, but your details are not (as are the OPs). Microsoft share's it's SSL certs with the entire planet. Microsoft protects it's private keys and does not share them with the NSA. The NSA forges Microsoft's SSL keys, they do not need to ask for them. https://en.wikipedia.org/wiki/Flame_(malware) https://en.wikipedia.org/wiki/Flame_(malware) Even with the mitigations provided by moving away from MD5, simple integration with a CA would be much more strategically beneficial.
- lern_too_spel 8y agoThanks. I skimmed GGP's comment and assumed it said something slightly more correct than what it actually said and then copy-pasted his error. > Even with the mitigations provided by moving away from MD5, simple integration with a CA would be much more strategically beneficial. Returning to the point, this attack would be unaffected by Microsoft purchasing anything.
- dorkusmcgavin 8y ago> Returning to the point, this attack would be unaffected by Microsoft purchasing anything. I was agreeing with you :)
- eranation 8y agoThere was a great post about this as a hypothetical attack vector and how CSP can help mitigate a large percentage of that surface, can’t find it now.
- yzmtf2008 8y ago"The NSA is after me" should be your least point of concern in evaluating a product to buy.
- LinuxBender 8y agoI agree with the concern around too many things depending on Github for real time builds and deployment. In regards to MITM, that can happen regardless of who maintains the repositories. If an NSL is issued, compliance is mandatory. A gag order is included. AFAIK there are no large organizations that would fall on that sword. It is on the individual organizations that utilize public resources to do proper certificate and checksum validation, along with code diff reviews to reduce the risk of tainted packages.