4 ms·

Hypothetically could they force BitBucket to inject code into repos or binary releases? I know git is signed, but how many consumers (who just download and comp

Hypothetically could they force BitBucket to inject code into repos or binary releases? I know git is signed, but how many consumers (who just download and compile) check the git log in the cloned repo actually match the the website?

jjcm 8y ago
It's one of the questions we're asking ourselves internally at atlassian. The only upside to the law is it was written without any idea of how modern software development works - any backdoor or explicit code injection should be caught at the pull request stage.
- rorykoehler 8y ago
  You have to move your company abroad or risk losing all your customers.
  - beokop 8y ago
    Move the company abroad and fire all their Australian staff, no less.
    - justinclift 8y ago
      They have Australian founders too. That makes things even more tricky. ;)
      - rorykoehler 8y ago
        Probably time for them to call it quits.
- woolvalley 8y ago
  What happens when the entire Australian staff get the order? Usually to sneak something in, you just need a clique of about 2-5 staff to write it, approve the change and get it deployed. If the company is large enough, most won't notice the rogue commit, and if %90 of the company gets the order, well good luck!
  - jay_kyburz 8y ago
    If I were some shady Australian spy organization, I wouldn't just demand an employee write some obvious change that rips open a backdoor, I would have my highly qualified spy programmers write a fix to an existing bug (ticket) in a repository, but inject a subtle bug (buffer overflow, unescaped input), then have a junior programmer commit it to the repository. The junior programmer might not even be able to spot the problem.
    - cormacrelf 8y ago
      I'm pretty sure ASIO et al only pushing so hard for this precisely because they are incapable of that fairly mundane level of sophistication. But yes, they could get better at it and we wouldn't know.
  - firecall 8y ago
    This is a very good point. I'd only considered it in the context of an individual.
- ehnto 8y ago
  They can ask your company directly, and anyone at your company, to formulate a method of injection. They don't really care how it seems, so a way to deliver code silently post PR is entirely within scope.
- Svenskunganka 8y ago
  But isn't it bad that the law isn't more specific? As it is right now, couldn't the one issuing the order specify exactly what steps the compelled need to take? I'm sure there are quite a few highly skilled individuals working for the Australian spy agency that could craft a method of implementation for a backdoor with a low possibility of detection. Especially if the compelled needs to disclose internal development and security practices. I haven't fully understood the law myself, so this is both speculation and a question.
- egeozcan 8y ago
  I just wanted to say that I'm really heart-broken about your situation regarding to this silly law. I hope you come out of it totally fine.
rorykoehler 8y ago
This is my main concern too. Leaving atlassian immediately which is a shame as I use them extensively.
- deleted 8y ago
  [deleted]

jjcm 8y ago

It's one of the questions we're asking ourselves internally at atlassian. The only upside to the law is it was written without any idea of how modern software development works - any backdoor or explicit code injection should be caught at the pull request stage.

rorykoehler 8y ago
You have to move your company abroad or risk losing all your customers.
- beokop 8y ago
  Move the company abroad and fire all their Australian staff, no less.
  - justinclift 8y ago
    They have Australian founders too. That makes things even more tricky. ;)
    - rorykoehler 8y ago
      Probably time for them to call it quits.
woolvalley 8y ago
What happens when the entire Australian staff get the order? Usually to sneak something in, you just need a clique of about 2-5 staff to write it, approve the change and get it deployed. If the company is large enough, most won't notice the rogue commit, and if %90 of the company gets the order, well good luck!
- jay_kyburz 8y ago
  If I were some shady Australian spy organization, I wouldn't just demand an employee write some obvious change that rips open a backdoor, I would have my highly qualified spy programmers write a fix to an existing bug (ticket) in a repository, but inject a subtle bug (buffer overflow, unescaped input), then have a junior programmer commit it to the repository. The junior programmer might not even be able to spot the problem.
  - cormacrelf 8y ago
    I'm pretty sure ASIO et al only pushing so hard for this precisely because they are incapable of that fairly mundane level of sophistication. But yes, they could get better at it and we wouldn't know.
- firecall 8y ago
  This is a very good point. I'd only considered it in the context of an individual.
ehnto 8y ago
They can ask your company directly, and anyone at your company, to formulate a method of injection. They don't really care how it seems, so a way to deliver code silently post PR is entirely within scope.
Svenskunganka 8y ago
But isn't it bad that the law isn't more specific? As it is right now, couldn't the one issuing the order specify exactly what steps the compelled need to take? I'm sure there are quite a few highly skilled individuals working for the Australian spy agency that could craft a method of implementation for a backdoor with a low possibility of detection. Especially if the compelled needs to disclose internal development and security practices. I haven't fully understood the law myself, so this is both speculation and a question.
egeozcan 8y ago
I just wanted to say that I'm really heart-broken about your situation regarding to this silly law. I hope you come out of it totally fine.

rorykoehler 8y ago

This is my main concern too. Leaving atlassian immediately which is a shame as I use them extensively.

deleted 8y ago
[deleted]