3 ms·

How can we protect against people like RIAEvnagelist and whole node-ipc fiasco who undermine whole point of OSS? Imagine if public admin app uses some library w

How can we protect against people like RIAEvnagelist and whole node-ipc fiasco who undermine whole point of OSS? Imagine if public admin app uses some library written by lunatic? Whole goverment system can be target of such terrorist attack.

ZeroGravitas 5y ago
I had to look up what RIAEvangelist was, but now I've done so, I'm not sure why we need protected from it: https://github.com/RIAEvangelist/peacenotwar https://github.com/RIAEvangelist/peacenotwar Seems like it's promoting good software security practices?
- smitop 5y ago
  At one point node-ipc deleted all files on the filesystem if the user had a Russian/Belarusian IP, they have since made it non-destructive (just adding a file to the desktop).
  - ZeroGravitas 5y ago
    Nothing on the GitHub repo suggests this is true, can you link to a reliable source for this info?
    - lapinot 5y ago
      https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0...
dgellow 5y ago
Proprietary software is very likely to rely on the same open source dependencies, also using NPM, pypi, etc, with the same baked assumptions that allow for that type of supply chain attack. Just saying that it’s a systematic problem in the way we use, manage, and consider 3rd party dependencies. And the risk already exist right now, without administration promoting open source software. (I don’t know how to protect against it at scale)
lapinot 5y ago
By having reputable sources. And most likely having people reviewing upgrades, what you're installing and what the building code is doing (and running it in a sandbox). This role is usually taken by the distribution's packagers. As some kind of users cooperative, distribution have very distinct incentives from software vendors. This separation has been eroded with the advent of self-publishing "app stores" (like the commercial ones, but also by npm, pypi, crates.io etc, and by flathub or snapcraft). See [1] and [2] from DeVault on this topic. This topic has been solved, it just needs manpower. And just because major distributions have some perceived bureaucratic overhead doesn't mean it's an intrinsic caracteristic. Official repos on arch, alpine and probably tons of other distribs are actually updated really quick and really simply (and still sometimes have patches applied to them, or support files, etc). [1] https://drewdevault.com/2019/12/09/Developers-shouldnt-distribute.html https://drewdevault.com/2019/12/09/Developers-shouldnt-distr... [2] https://drewdevault.com/2021/09/27/Let-distros-do-their-job.html https://drewdevault.com/2021/09/27/Let-distros-do-their-job.... PS: These aren't "terrorist attacks". It's quite emotional, judgmental and not very precise nor meaningful. Some random dude pushed malware in a supply-chain attack. From wikipedia on terrorism: > Having the connotation of "something morally wrong", the term "terrorism" is often used to abuse or denounce opposite parties, either governments or non-state groups. > It is common for both parties in a conflict to describe each other as terrorists.
- pokepim 5y ago
  Well to me it was clearly attempt to wage war against civilians, so the definition should apply. What if that malware ended up in Russian hospital which treated sick children?

ZeroGravitas 5y ago

I had to look up what RIAEvangelist was, but now I've done so, I'm not sure why we need protected from it: https://github.com/RIAEvangelist/peacenotwar https://github.com/RIAEvangelist/peacenotwar Seems like it's promoting good software security practices?

smitop 5y ago
At one point node-ipc deleted all files on the filesystem if the user had a Russian/Belarusian IP, they have since made it non-destructive (just adding a file to the desktop).
- ZeroGravitas 5y ago
  Nothing on the GitHub repo suggests this is true, can you link to a reliable source for this info?
  - lapinot 5y ago
    https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0...

dgellow 5y ago

Proprietary software is very likely to rely on the same open source dependencies, also using NPM, pypi, etc, with the same baked assumptions that allow for that type of supply chain attack. Just saying that it’s a systematic problem in the way we use, manage, and consider 3rd party dependencies. And the risk already exist right now, without administration promoting open source software. (I don’t know how to protect against it at scale)

lapinot 5y ago

By having reputable sources. And most likely having people reviewing upgrades, what you're installing and what the building code is doing (and running it in a sandbox). This role is usually taken by the distribution's packagers. As some kind of users cooperative, distribution have very distinct incentives from software vendors. This separation has been eroded with the advent of self-publishing "app stores" (like the commercial ones, but also by npm, pypi, crates.io etc, and by flathub or snapcraft). See [1] and [2] from DeVault on this topic. This topic has been solved, it just needs manpower. And just because major distributions have some perceived bureaucratic overhead doesn't mean it's an intrinsic caracteristic. Official repos on arch, alpine and probably tons of other distribs are actually updated really quick and really simply (and still sometimes have patches applied to them, or support files, etc). [1] https://drewdevault.com/2019/12/09/Developers-shouldnt-distribute.html https://drewdevault.com/2019/12/09/Developers-shouldnt-distr... [2] https://drewdevault.com/2021/09/27/Let-distros-do-their-job.html https://drewdevault.com/2021/09/27/Let-distros-do-their-job.... PS: These aren't "terrorist attacks". It's quite emotional, judgmental and not very precise nor meaningful. Some random dude pushed malware in a supply-chain attack. From wikipedia on terrorism: > Having the connotation of "something morally wrong", the term "terrorism" is often used to abuse or denounce opposite parties, either governments or non-state groups. > It is common for both parties in a conflict to describe each other as terrorists.

pokepim 5y ago
Well to me it was clearly attempt to wage war against civilians, so the definition should apply. What if that malware ended up in Russian hospital which treated sick children?