4 ms·

Backdoored developer tool that stole credentials escaped notice for 3 months

• jka 6y ago
  Finding accidental and/or malicious information leaks like this is going to be the reality of the next decade or so of open source network service development. Some will argue that's a reason not to trust open source; but the truth is that leaks and problems are much easier to hide (and thus for organizations to fail to address) in closed source codebases. This hasn't quite reached public perception for some reason - users don't tend to know that many popular videoconferencing tools and social networks are closed source. But I think it is a reasonably straightforward and useful distinction to explain (without claiming that FLOSS software is perfect, which it isn't). Investing in detection tools (at both the code level and network level) is probably a good idea - and the same source availability and leak analysis rules apply to them to (perhaps moreso).
• rurban 6y ago
  Because it was hard to notice. I was told I was a victim of it. I compared the bash uploader which I saved in March to the malicious one, which was used dynamically in GH actions. I didn't see any such suspicious upload line. But I cannot inspect the bash script which is downloaded from a GH action. So the easiest fix would be to just use a static script. This would forbid improvements though.