5 ms·

>... that individual employees could be targeted by law enforcement to make secret changes to systems So with the TOLA act, who is under the Australian governm

by rovyko 8y ago

>... that individual employees could be targeted by law enforcement to make secret changes to systems So with the TOLA act, who is under the Australian government's jurisdiction and can be compelled to do this? Only those residing in Australia? Any citizen anywhere in the world? Anyone with assets or interests that could be leveraged? What does this mean for Australians seeking employment in other countries? https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6195 https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...

x0x0 8y ago
it means if the PR was submitted by an Aussie (or resident) you better make sure your code review has a non-Aussie on it.
- rovyko 8y ago
  Do you think the presence of a code review practices alone will be enough of a deterrent against agencies using devs for this purpose? Even if you pressure someone to make a backdoor and they get caught, you've just exposed your intentions when it could have been easier to go straight to the company.
  - 420codebro 8y ago
    This. If you are going to go through the effort to compromise key developers, you probably are going to have a team of people grinding on it for him. Eventually you come to him and say "modify this function in this way, and if you get caught, this is your story". Said story would be near perfectly defensible - and at worst case he/she can feign a typo/error and graciously accept someone calling it out and fixing it. Then they just wait a while and attempt again sometime.
  - mikerg87 8y ago
    I don’t think A PR is the only attack vector. I would be suspect of the entire CI/CD pipeline and any production systems or distribution systems in employed
    - MrEldritch 8y ago
      Also, if I were an Aussie and I'd gotten a request like this, I'd feel pretty incentivized to make the backdoor as blatant and suspicious-looking as possible. The government ordered you to do it; it did not order you to do a good job. So "evil PR" would probably be the easiest thing to catch, and it definitely seems like other compromise vectors are where the real danger is.
      - noir_lord 8y ago
        public function rot13_GbgnyylAbgNOnpxqbbe() Something subtle like that? Fwiw the UK has near identical legislation and I'm pretty sure the Aussie gov looked at ours first. We lead the world in subtly corrupting democracy.
      - zuccs 8y ago
        What if you accidentally cast your coding session to your Twitch stream?

by rovyko 8y ago

x0x0 8y ago

it means if the PR was submitted by an Aussie (or resident) you better make sure your code review has a non-Aussie on it.

rovyko 8y ago
Do you think the presence of a code review practices alone will be enough of a deterrent against agencies using devs for this purpose? Even if you pressure someone to make a backdoor and they get caught, you've just exposed your intentions when it could have been easier to go straight to the company.
- 420codebro 8y ago
  This. If you are going to go through the effort to compromise key developers, you probably are going to have a team of people grinding on it for him. Eventually you come to him and say "modify this function in this way, and if you get caught, this is your story". Said story would be near perfectly defensible - and at worst case he/she can feign a typo/error and graciously accept someone calling it out and fixing it. Then they just wait a while and attempt again sometime.
- mikerg87 8y ago
  I don’t think A PR is the only attack vector. I would be suspect of the entire CI/CD pipeline and any production systems or distribution systems in employed
  - MrEldritch 8y ago
    Also, if I were an Aussie and I'd gotten a request like this, I'd feel pretty incentivized to make the backdoor as blatant and suspicious-looking as possible. The government ordered you to do it; it did not order you to do a good job. So "evil PR" would probably be the easiest thing to catch, and it definitely seems like other compromise vectors are where the real danger is.
    - noir_lord 8y ago
      public function rot13_GbgnyylAbgNOnpxqbbe() Something subtle like that? Fwiw the UK has near identical legislation and I'm pretty sure the Aussie gov looked at ours first. We lead the world in subtly corrupting democracy.
    - zuccs 8y ago
      What if you accidentally cast your coding session to your Twitch stream?