3 ms·

Signing would not have helped at all here - the author decided to nuke their project (and likely their last reputation), they could have signed that commit/pack

Signing would not have helped at all here - the author decided to nuke their project (and likely their last reputation), they could have signed that commit/package.

bcrl 5y ago
Requiring multiple signatures from several trusted sources would have.
- bcrl 5y ago
  I'm seriously downvoted for this? We have just had an incident where a maintainer acted maliciously and has demonstrated that a single point of trust is insufficient. If we really care about avoiding issues with open source software, clearly it is necessary to get multiple maintainers to sign off on changes to widely used open source projects. We have had all the technology components needed to implement this for decades, we just need the will to implement a system that is better. If we don't use this incident to improve, then it's going to happen again, and maybe the consequences will be worse.
  - dane-pgp 5y ago
    I'm saddened to see you getting downvoted too (and I've tried to compensate for that). You're right that more ecosystems need something like Crev: https://dpc.pw/cargo-crev-and-rust-2019-fearless-code-reuse https://dpc.pw/cargo-crev-and-rust-2019-fearless-code-reuse
    - bcrl 5y ago
      Crev looks interesting. Most Linux distributions are using a single key for the signing of packages, and this might be an easier place to start changing over to a multiple signature model. In this particular case is was a single jilted developer, but determined actor could easily attack someone with access to the keys to sign compromised packages, as per the obligatory xkcd on the matter https://xkcd.com/538/ https://xkcd.com/538/ .
      - dane-pgp 5y ago
        Multiple signatures would indeed be a good mitigation against coercion, especially if the signatories were in different jurisdictions. Ideally you'd want a system which separates reputation from meatspace identity, so that well-trusted reviewers couldn't be easily targeted offline. Unfortunately that would require a lot of good opsec, and go against the financial incentive for someone to disclose their online identity as part of a salary negotiation, for example.
- Yoofie 5y ago
  How would that work?

Signing would not have helped at all here - the author decided to nuke their project (and likely their last reputation), they could have signed that commit/package.

bcrl 5y ago

Requiring multiple signatures from several trusted sources would have.

bcrl 5y ago
I'm seriously downvoted for this? We have just had an incident where a maintainer acted maliciously and has demonstrated that a single point of trust is insufficient. If we really care about avoiding issues with open source software, clearly it is necessary to get multiple maintainers to sign off on changes to widely used open source projects. We have had all the technology components needed to implement this for decades, we just need the will to implement a system that is better. If we don't use this incident to improve, then it's going to happen again, and maybe the consequences will be worse.
- dane-pgp 5y ago
  I'm saddened to see you getting downvoted too (and I've tried to compensate for that). You're right that more ecosystems need something like Crev: https://dpc.pw/cargo-crev-and-rust-2019-fearless-code-reuse https://dpc.pw/cargo-crev-and-rust-2019-fearless-code-reuse
  - bcrl 5y ago
    Crev looks interesting. Most Linux distributions are using a single key for the signing of packages, and this might be an easier place to start changing over to a multiple signature model. In this particular case is was a single jilted developer, but determined actor could easily attack someone with access to the keys to sign compromised packages, as per the obligatory xkcd on the matter https://xkcd.com/538/ https://xkcd.com/538/ .
    - dane-pgp 5y ago
      Multiple signatures would indeed be a good mitigation against coercion, especially if the signatories were in different jurisdictions. Ideally you'd want a system which separates reputation from meatspace identity, so that well-trusted reviewers couldn't be easily targeted offline. Unfortunately that would require a lot of good opsec, and go against the financial incentive for someone to disclose their online identity as part of a salary negotiation, for example.
Yoofie 5y ago
How would that work?