4 ms·

As much as I love open source, Gab should have never been open source. It seems very unwise to make a highly targeted free speech social media platform availabl

As much as I love open source, Gab should have never been open source. It seems very unwise to make a highly targeted free speech social media platform available for easy backend code analysis. No wonder they were hacked. https://git.rip/gab/gab-social https://git.rip/gab/gab-social

busrf 6y ago
I believe they had to release their source code in order to comply with the AGPL, because they forked off mastodon right? I’m not sure if they decided to go with mastodon as the basis for their codebase in the beginning or if that was a later decision.
- asabjorn 6y ago
  Thats a good point. And because of this they are limited in their mitigation strategies.
  - busrf 6y ago
    I just looked it up and the history is that they did it so that users could access the site using fediverse clients, because their own clients were getting pulled from app stores. https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-network-gab-migration-fediverse-app-blocking https://www.theverge.com/2019/7/12/20691957/mastodon-decentr... ofc there is that whole discussion about whether open sourcing actually affects application security, having your security model assume that attackers already have access to the source code, etc. Not to mention it looks like they did make quite extensive modifications on top of the mastodon code. Some of the code that people have discovered lying around in the gab codebase is really embarrassing.
xahrepap 6y ago
I don’t believe that Open Source == Less Secure. See also: Linux, Ngix, Postgres... Many many open source projects are secure. They’re not perfect but an argument could be made that they’re more secure BECAUSE they’re open. Software with crosshairs on its back practicing garbage security practices will be pwnd the same regardless of it’s open-ness. Honestly. With a lot of the tools out there these days. I question if it’s even faster to hunt security bugs by reading the source rather than just attempting common exploits via tooling.
- asabjorn 6y ago
  It is way easier to find a software vulnerability in a backend you have the code for, instead of probing a black-box backend for vulnerabilities. For instance, you can use static analysis tools to discover vulnerabilities.
  - industriousthou 6y ago
    So way more people are able to identify those vulnerabilities and fix them?
    - o_p 6y ago
      Sure, after they stole your data already
- cm2187 6y ago
  There are probably a lot more eyes on a generic tool used everywhere than on the source code of a single web service.
- FDSGSG 6y ago
  How is Linux supposed to be a good example of a secure open source project? I'm not really convinced by Postgres either, software like that inherently exposes very little attack surface unless the attackers already have access. Nobody is interested in exploiting Postgres.
spideymans 6y ago
If you’re depending on the confidentiality of your source code to keep your system secure, then your system was never secure in the first place.
- asabjorn 6y ago
  That is not a fair assertion, as source confidentiality to limit wide-spread computerized and manual inspection of backend code to find flaws is just one of many tools to mitigate attacks. For instance, in this case a group with sufficient security research skills politically opposed to some of the gab users seem to have utilized the source-code to find a vulnerability the Gab team had not discovered yet.
  - kuschku 6y ago
    Not just one vulnerability, gab's CTO replaced every activerecord and stored procedure SQL call he could find with a string substitution based raw query (without any escaping or anything)
glenngillen 6y ago
Isn't this the reason most privacy conscious people advocate for OSS solutions? Precisely because their security can be verified and not prone to some undocumented backdoor that is secure purely through obscurity. Also "many eyes make all bugs shallow" etc etc.
- asabjorn 6y ago
  In the case of Gab "many eyes make all bugs shallow", but those eyes in this case had malevolent intent so the value of those extra eyes is dubious for a platform with as many high-skilled tech enemies as Gab has.
  - Jach 6y ago
    It would be wild if there was some coordination of an intentional vulnerability in Mastodon or one of its dependencies. I don't think it happened here but I can easily imagine the future of open source moving in that direction, i.e. trying to damage entities whom project maintainers don't like who use their liberally licensed software (which has no warranty). Already Gab exposed that federation is just another rake to step on and doesn't necessarily save you -- their wiki page has a section that sums up the immediate reaction after their switch: "Mastodon stated that most Mastodon instances had blocked Gab's domains, preventing interactions between these instances and Gab,[47] and that Tusky and Toot!, two popular Mastodon mobile apps, had already blacklisted Gab's domains and banned Gab users from using their app"
yibg 6y ago
So, prefer security by obscurity?
- asabjorn 6y ago
  No, use a varied set of mitigation strategies that fit your use-case.

busrf 6y ago

I believe they had to release their source code in order to comply with the AGPL, because they forked off mastodon right? I’m not sure if they decided to go with mastodon as the basis for their codebase in the beginning or if that was a later decision.

asabjorn 6y ago
Thats a good point. And because of this they are limited in their mitigation strategies.
- busrf 6y ago
  I just looked it up and the history is that they did it so that users could access the site using fediverse clients, because their own clients were getting pulled from app stores. https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-network-gab-migration-fediverse-app-blocking https://www.theverge.com/2019/7/12/20691957/mastodon-decentr... ofc there is that whole discussion about whether open sourcing actually affects application security, having your security model assume that attackers already have access to the source code, etc. Not to mention it looks like they did make quite extensive modifications on top of the mastodon code. Some of the code that people have discovered lying around in the gab codebase is really embarrassing.

xahrepap 6y ago

I don’t believe that Open Source == Less Secure. See also: Linux, Ngix, Postgres... Many many open source projects are secure. They’re not perfect but an argument could be made that they’re more secure BECAUSE they’re open. Software with crosshairs on its back practicing garbage security practices will be pwnd the same regardless of it’s open-ness. Honestly. With a lot of the tools out there these days. I question if it’s even faster to hunt security bugs by reading the source rather than just attempting common exploits via tooling.

asabjorn 6y ago
It is way easier to find a software vulnerability in a backend you have the code for, instead of probing a black-box backend for vulnerabilities. For instance, you can use static analysis tools to discover vulnerabilities.
- industriousthou 6y ago
  So way more people are able to identify those vulnerabilities and fix them?
  - o_p 6y ago
    Sure, after they stole your data already
cm2187 6y ago
There are probably a lot more eyes on a generic tool used everywhere than on the source code of a single web service.
FDSGSG 6y ago
How is Linux supposed to be a good example of a secure open source project? I'm not really convinced by Postgres either, software like that inherently exposes very little attack surface unless the attackers already have access. Nobody is interested in exploiting Postgres.

spideymans 6y ago

If you’re depending on the confidentiality of your source code to keep your system secure, then your system was never secure in the first place.

asabjorn 6y ago
That is not a fair assertion, as source confidentiality to limit wide-spread computerized and manual inspection of backend code to find flaws is just one of many tools to mitigate attacks. For instance, in this case a group with sufficient security research skills politically opposed to some of the gab users seem to have utilized the source-code to find a vulnerability the Gab team had not discovered yet.
- kuschku 6y ago
  Not just one vulnerability, gab's CTO replaced every activerecord and stored procedure SQL call he could find with a string substitution based raw query (without any escaping or anything)

glenngillen 6y ago

Isn't this the reason most privacy conscious people advocate for OSS solutions? Precisely because their security can be verified and not prone to some undocumented backdoor that is secure purely through obscurity. Also "many eyes make all bugs shallow" etc etc.

asabjorn 6y ago
In the case of Gab "many eyes make all bugs shallow", but those eyes in this case had malevolent intent so the value of those extra eyes is dubious for a platform with as many high-skilled tech enemies as Gab has.
- Jach 6y ago
  It would be wild if there was some coordination of an intentional vulnerability in Mastodon or one of its dependencies. I don't think it happened here but I can easily imagine the future of open source moving in that direction, i.e. trying to damage entities whom project maintainers don't like who use their liberally licensed software (which has no warranty). Already Gab exposed that federation is just another rake to step on and doesn't necessarily save you -- their wiki page has a section that sums up the immediate reaction after their switch: "Mastodon stated that most Mastodon instances had blocked Gab's domains, preventing interactions between these instances and Gab,[47] and that Tusky and Toot!, two popular Mastodon mobile apps, had already blacklisted Gab's domains and banned Gab users from using their app"

yibg 6y ago

So, prefer security by obscurity?

asabjorn 6y ago
No, use a varied set of mitigation strategies that fit your use-case.