5 ms·
Ask HN: Do people really believe that JetBrains software might be compromised?
I am just a reasonably satisfied customer of JetBrains. Their products are the best options, and their willingness to fix bugs is admirable. In the past 24 hours, I have seen several (about 5 or so) posts to twitter and other chat channels in response to the NYT article https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html asking questions like "It's unclear to me if I should uninstall PyCharm.".
JetBrains response is here https://blog.jetbrains.com/blog/2021/01/06/statement-on-the-story-from-the-new-york-times-regarding-jetbrains-and-solarwinds/
Are people really concerned that this is a credible threat?
- zn44 6y agoI'd assume most of the people posting this happily instal random packages from npm without second thought. Surely it can be a potential threat but in most case there is a VERY long list of things you need to secure before it's reasonable to worry about your IDE
- gjvc 6y agoI agree with you on both counts. One of my first jobs was wearing a build engineer hat building software in a completely clean-room environment (no network, nothing), using completely vanilla installations of operating systems and compilers. A few years later, when I moved to Java, I was shocked to see people download .jar files from the central Maven repository without a care in the world, use them in development and do the same process for production. A few years after that, npm came along and made it normal for Javascript. By this time there appeared to be no stopping the madness, and incidents like this https://www.theregister.com/2016/03/23/npm_left_pad_chaos/ https://www.theregister.com/2016/03/23/npm_left_pad_chaos/ seemingly failed to give people pause. CI/CD as practised today contains huge risks on what is ingested to a given corporate infrastructure -- millions of lines of code from external sources of differing security levels. But instead of all that in plain sight, a single inaccurate article based on speculation can get people worried about something else. (related, but as you say, a very long way off from the most targets potentially most vulnerable and valuable-to-an-attacker). Crazy.
- burntoutfire 6y agoI'm guessing companies assume that whatever code gets written in-house will have more vulns that some widely used open source project... Not to mention the cost to re-implement the world (sans the OS and compiler) would be astronomical and put most projects into the "not worth it" category.
- gjvc 6y agoI'm not talking about not-reinventing-the-wheel, I'm talking about making network calls by default, to fetch dependencies. This makes review of such things seem obstructive. As ever, convenience and security are opposing forces.
- hctaw 6y agoWe know that the build and release infrastructure for SolarWinds was compromised to distribute malware signed with their keys. What we don't know is who or what was responsible. In the sense that JetBrains is in the supply chain and that supply chain was ultimately compromised, the threat is absolutely credible. Other credible threats include every human who touched or has the ability to touch the configuration of their Team City pipelines. However, the Times journalists should get some facts straight before flinging libel around. There are millions of JetBrains users for a wide variety of products. They're implicating all these products, and that doesn't seem to be appropriate. Breaking a text editor or IDE to introduce this class of attack seems unlikely, and much more prone to discovery. Personally, everything about this smells like an inside job (or gross incompetence).
- gjvc 6y agoRoger that, and I acknowledge and agree with you.