5 ms·

Not actually malicious. It doesn't steal user data, drop malware, or damage a computer. Just crashes the library. Looks like another developer-developer slap fi

by ga-vu 7y ago

Not actually malicious. It doesn't steal user data, drop malware, or damage a computer. Just crashes the library. Looks like another developer-developer slap fight.

braythwayt 7y ago
I beg your pardon, but if I am using this library as part of a shipping piece of software-as-a-service, and I am in the middle of shipping a new feature when suddenly things mysteriously crash... If I later discover that the crash was put there deliberately, I am going to call that malice, and malice that has directly impacted a functioning business and its customers. It's no different than a disgruntled person putting tacks on the road outside of a supplier. If my truck goes there, gets a flat, and crashes into the ditch as a result, I would call that malice as well. Deliberately crashing software that other people depend upon is malice.
- johnchristopher 7y ago
  > If I later discover that the crash was put there deliberately, I am going to call that malice, and malice that has directly impacted a functioning business and its customers. Hey, it's open source party ! Where is your patch ? /s edit: oh, bummer. Not really open source. Still: THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, etc. How are we supposed to have code free of malice in the current javascript ecosystem ?
  - luckylion 7y ago
    You touch on an interesting point there if the typical disclaimer is included: does that actually protect against willfully damaging code? It's certainly (and reasonably so) very hard to hold a developer accountable for a bug in an open source library they published. But what if they put rm -rf / in the installer with the intent to delete the files of anybody running it? Does "you should've looked" really work there, or is there an assumption of good nature and malicious behavior voids the disclaimer?
    - aidenn0 7y ago
      Obviously everything depends on what court has jurisdiction, but aside from the fact that such disclaimers already have little weight, even signed waivers will not protect you from malice or neglect in many places.
- dcbadacd 7y ago
  The refund for the amount you paid for the library is on its way. Once again I'm reminded about that sentence someone once said. With random open-source libraries you're dealing with something someone else put out there just because they wanted to, having any kinds of expectations that someone will or won't do something is seriously short-sighted and even pretentious. Do you go around running random .exe-s you find from the internet? Why do you do so with the dependencies for your projects and expect a better end result? You may not like to hear this but it's true. There's two solutions here, either you start reviewing the libraries you use, every release, or sign a support contract that obliges the maintainer to do something you want.
  - braythwayt 7y ago
    You are not a lawyer, because if you were, you would be aware that there is case law establishing that just because you don't charge for it, doesn't mean you aren't providing an implied warranty and aren't taking implied liability. There is absolutely zero chance that you can put malware into an open source project, give it away, and then when sued, stand up and say, "It was free, what do people expect?" You can call me pretentious until night turns back into day, and maybe I am, but the thing we're discussing is a matter of law, and it there are nuänces above and beyond what random people on the Internet would like to believe about how giving software away works. (edited to add a pretentious diæresis)
    - dcbadacd 7y ago
      I don't know how you believe laws work or what you hope to discuss but the reality is that in the case of software, laws offer deterrence and recourse to any malicious actions. It's absolutely stupid to take a repository by an anonymous person, execute it and hope it's not malicious or doesn't have any bugs. Not to mention there's nothing obliging that a piece of software has to be bug free, maintained - go and now determine if a bug that deleted your production data is malicious and if you have any recourse. I'd love to see any actual cases about software distribution causing damage that don't have anything to do with malware distribution.
      - 7y ago
- danShumway 7y ago
  It's malicious. That being said, I always get pushback when I mention this but I think SaaS projects should often be vendoring dependencies. It's safer, it's more secure, it gives you more consistent installs -- and it prevents `leftpad` scenarios. It makes source control slightly more complicated, but the other benefits (often) greatly outweigh that. This is something that used to be more commonplace in the Javascript community, and it's something that `node_modules` makes very easy, but it's fallen out of style in modern web development. To the best of my knowledge, this was also commonplace in the original design of Go, since it was coming out of Google, which does vendor all of its dependencies. I'm not sure which way the current Go community leans.
  - d4mi3n 7y ago
    Vendoring as practice isn’t common in some ecosystems (ruby, JavaScript, python, Clojure), but I do see more people using caching proxies and services like JFrog’s to ensure they always have access to particular versions of a dependency. Sadly, this still doesn’t fix non-repudiation problems we see in ecosystems that don’t enforce things like package signing.
- hnbroseph 7y ago
  it would also be some contributory negligence if someone is shipping a service that just grabs and includes unsigned/unvetted/untested code from the internet as a component...
JulianMorrison 7y ago
It's childish and amounts to an indirect attempt at damaging the reputation of the compiler maintainers. It's playing fast and loose with everyone who needs an install up and working for reasons. I'd say there was a heap of malice and it reflects very badly on mister "someone gained access to my account".
- hombre_fatal 7y ago
  It's truly mind-blowing how this @shinnn character chose to handle this. It's so petty that I would actually have more respect for them had they snuck in something more devastating, like scanning for bitcoin privkeys.
johnchristopher 7y ago
> Just crashes the library. Which damages everything that relies on it, so... Yeah, malicious (as in `malice` and as in `let's hide it`).
orblivion 7y ago
While people give reasonable counter-arguments here to your point, it gets me thinking - I wonder if we could find a truly benign form of "malicious code" that "good guys" could use to find attack vectors before the "bad guys" do. Perhaps there could be a website set up to get pinged by "malicious" installers? Perhaps it displays stats of some sort? It could turn into a friendly game.
- elliekelly 7y ago
  I actually built something like this a few months ago. I called it “OSSassin” (like the game[1]) so devs could sign up & get a unique ID/url to ping with the idea that everyone participating would then try to secretly, and not maliciously, “assassinate” the packages that have agreed to participate by sneaking in code to ping their endpoint. Just as a fun/friendly game to help identify potential vulnerabilities. It has a leaderboard for “kills” but it’s currently empty because I never released it. While I’ve got some experience using packages, I’m still pretty new at software development & have never really been involved maintaining any packages. So I guess what I’m saying is I’m not entirely confident the way I built it made sense until I just saw your comment. I also wanted to add GitHub OAuth as a way to verify/limit who was participating but I never got around to it. I’m on my phone at the moment but if you (or anyone else) has the knowledge/interest in taking a look at what I’ve done I’d love to release it with a partner. [1] https://en.m.wikipedia.org/wiki/Assassin_(game) https://en.m.wikipedia.org/wiki/Assassin_(game)
  - dane-pgp 7y ago
    That sounds like a really fun gamification of an aspect of security research that maybe doesn't get much practical exploration. I'm not sure, though, how the game would distinguish between vulnerable code pinging the endpoint, as opposed to a player simulating a successful attack by performing the ping themselves. I feel like the attacker should be able to provide a link to a package on a software repo somewhere and the game should download the package and check for some unique "Player 123456 attacked this package" string. This reminds me of a similar game someone created where they challenged people to add a certain string to any repo that the challenge creator maintained. An ingenious social engineer then pointed out that the rules of this game weren't in an easy to find place, so the challenge creator added a page to their blog, which was under version control... Game over. Unfortunately I can't remember any detail that would allow me to find a citation for this story.

by ga-vu 7y ago

Not actually malicious. It doesn't steal user data, drop malware, or damage a computer. Just crashes the library. Looks like another developer-developer slap fight.

braythwayt 7y ago

I beg your pardon, but if I am using this library as part of a shipping piece of software-as-a-service, and I am in the middle of shipping a new feature when suddenly things mysteriously crash... If I later discover that the crash was put there deliberately, I am going to call that malice, and malice that has directly impacted a functioning business and its customers. It's no different than a disgruntled person putting tacks on the road outside of a supplier. If my truck goes there, gets a flat, and crashes into the ditch as a result, I would call that malice as well. Deliberately crashing software that other people depend upon is malice.

johnchristopher 7y ago
> If I later discover that the crash was put there deliberately, I am going to call that malice, and malice that has directly impacted a functioning business and its customers. Hey, it's open source party ! Where is your patch ? /s edit: oh, bummer. Not really open source. Still: THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, etc. How are we supposed to have code free of malice in the current javascript ecosystem ?
- luckylion 7y ago
  You touch on an interesting point there if the typical disclaimer is included: does that actually protect against willfully damaging code? It's certainly (and reasonably so) very hard to hold a developer accountable for a bug in an open source library they published. But what if they put rm -rf / in the installer with the intent to delete the files of anybody running it? Does "you should've looked" really work there, or is there an assumption of good nature and malicious behavior voids the disclaimer?
  - aidenn0 7y ago
    Obviously everything depends on what court has jurisdiction, but aside from the fact that such disclaimers already have little weight, even signed waivers will not protect you from malice or neglect in many places.
dcbadacd 7y ago
The refund for the amount you paid for the library is on its way. Once again I'm reminded about that sentence someone once said. With random open-source libraries you're dealing with something someone else put out there just because they wanted to, having any kinds of expectations that someone will or won't do something is seriously short-sighted and even pretentious. Do you go around running random .exe-s you find from the internet? Why do you do so with the dependencies for your projects and expect a better end result? You may not like to hear this but it's true. There's two solutions here, either you start reviewing the libraries you use, every release, or sign a support contract that obliges the maintainer to do something you want.
- braythwayt 7y ago
  You are not a lawyer, because if you were, you would be aware that there is case law establishing that just because you don't charge for it, doesn't mean you aren't providing an implied warranty and aren't taking implied liability. There is absolutely zero chance that you can put malware into an open source project, give it away, and then when sued, stand up and say, "It was free, what do people expect?" You can call me pretentious until night turns back into day, and maybe I am, but the thing we're discussing is a matter of law, and it there are nuänces above and beyond what random people on the Internet would like to believe about how giving software away works. (edited to add a pretentious diæresis)
  - dcbadacd 7y ago
    I don't know how you believe laws work or what you hope to discuss but the reality is that in the case of software, laws offer deterrence and recourse to any malicious actions. It's absolutely stupid to take a repository by an anonymous person, execute it and hope it's not malicious or doesn't have any bugs. Not to mention there's nothing obliging that a piece of software has to be bug free, maintained - go and now determine if a bug that deleted your production data is malicious and if you have any recourse. I'd love to see any actual cases about software distribution causing damage that don't have anything to do with malware distribution.
    - 7y ago
danShumway 7y ago
It's malicious. That being said, I always get pushback when I mention this but I think SaaS projects should often be vendoring dependencies. It's safer, it's more secure, it gives you more consistent installs -- and it prevents `leftpad` scenarios. It makes source control slightly more complicated, but the other benefits (often) greatly outweigh that. This is something that used to be more commonplace in the Javascript community, and it's something that `node_modules` makes very easy, but it's fallen out of style in modern web development. To the best of my knowledge, this was also commonplace in the original design of Go, since it was coming out of Google, which does vendor all of its dependencies. I'm not sure which way the current Go community leans.
- d4mi3n 7y ago
  Vendoring as practice isn’t common in some ecosystems (ruby, JavaScript, python, Clojure), but I do see more people using caching proxies and services like JFrog’s to ensure they always have access to particular versions of a dependency. Sadly, this still doesn’t fix non-repudiation problems we see in ecosystems that don’t enforce things like package signing.
hnbroseph 7y ago
it would also be some contributory negligence if someone is shipping a service that just grabs and includes unsigned/unvetted/untested code from the internet as a component...

JulianMorrison 7y ago

It's childish and amounts to an indirect attempt at damaging the reputation of the compiler maintainers. It's playing fast and loose with everyone who needs an install up and working for reasons. I'd say there was a heap of malice and it reflects very badly on mister "someone gained access to my account".

hombre_fatal 7y ago
It's truly mind-blowing how this @shinnn character chose to handle this. It's so petty that I would actually have more respect for them had they snuck in something more devastating, like scanning for bitcoin privkeys.

johnchristopher 7y ago

> Just crashes the library. Which damages everything that relies on it, so... Yeah, malicious (as in `malice` and as in `let's hide it`).

orblivion 7y ago

While people give reasonable counter-arguments here to your point, it gets me thinking - I wonder if we could find a truly benign form of "malicious code" that "good guys" could use to find attack vectors before the "bad guys" do. Perhaps there could be a website set up to get pinged by "malicious" installers? Perhaps it displays stats of some sort? It could turn into a friendly game.

elliekelly 7y ago
I actually built something like this a few months ago. I called it “OSSassin” (like the game[1]) so devs could sign up & get a unique ID/url to ping with the idea that everyone participating would then try to secretly, and not maliciously, “assassinate” the packages that have agreed to participate by sneaking in code to ping their endpoint. Just as a fun/friendly game to help identify potential vulnerabilities. It has a leaderboard for “kills” but it’s currently empty because I never released it. While I’ve got some experience using packages, I’m still pretty new at software development & have never really been involved maintaining any packages. So I guess what I’m saying is I’m not entirely confident the way I built it made sense until I just saw your comment. I also wanted to add GitHub OAuth as a way to verify/limit who was participating but I never got around to it. I’m on my phone at the moment but if you (or anyone else) has the knowledge/interest in taking a look at what I’ve done I’d love to release it with a partner. [1] https://en.m.wikipedia.org/wiki/Assassin_(game) https://en.m.wikipedia.org/wiki/Assassin_(game)
- dane-pgp 7y ago
  That sounds like a really fun gamification of an aspect of security research that maybe doesn't get much practical exploration. I'm not sure, though, how the game would distinguish between vulnerable code pinging the endpoint, as opposed to a player simulating a successful attack by performing the ping themselves. I feel like the attacker should be able to provide a link to a package on a software repo somewhere and the game should download the package and check for some unique "Player 123456 attacked this package" string. This reminds me of a similar game someone created where they challenged people to add a certain string to any repo that the challenge creator maintained. An ingenious social engineer then pointed out that the rules of this game weren't in an easy to find place, so the challenge creator added a page to their blog, which was under version control... Game over. Unfortunately I can't remember any detail that would allow me to find a citation for this story.