3 ms·

Your concerns are absolutely valid. Without casting any judgement on this project, the process of taking, modifying, and redistributing is hard to do in a trust

Your concerns are absolutely valid. Without casting any judgement on this project, the process of taking, modifying, and redistributing is hard to do in a trustworthy way. Big companies go to extreme lengths to ensure a chain of trust of the software they build, and app distribution platforms[^1] go to extreme lengths to ensure a full chain of trust end-to-end[^2] from developer to apps running on users devices. There's basically no way to do this without trusting the redistributor in addition to the original publisher, but some things can reduce the amount of trust. Having a verifiable build process, that checks signing keys and hashes, that re-signs, etc, that all helps. If end-users can theoretically produce exactly the same build themselves it's easier to trust it. The best option however is for the source project to produce unbranded builds themselves, and potentially for a project like VSCodium to become "config only" for things like disabling telemetry, and therefore not requiring re-signing. The Chromium project distributes its own Chromium binaries which lack the Google-specific stuff for example. [^1]: Mostly thinking of app stores, but the same is basically true of things like Debian package repositories. [^2]: App stores typically re-sign in the middle, so you do have to trust the store, but see (1), these companies go to great lengths to ensure trustworthiness there.

sqeaky 3y ago
Trusting "big companies" because we presume they have guard rails seems like a bad idea, it is how we got the solar winds supply chain attack. When I worked for one of the largest voting machine companies I was astounded how the final build process for the software was done just before it was sent to the customer. It was built on a Jenkins server that several people had access to change and update with minimal oversight and the devops person had freedom to do anything to with no oversight. For the year I worked there this one man could have changed dozens of elections if he chose to and figuring it out would have been very hard. I am sure a large enough investigation could could have figured out such a thing, but by then the damage would already be done. If he changed only municipal elections that couldn't affors such an investigation it might never have been done. I have no reason to claim this happened, but we certainly can't prove it didn't and this is in one of the most paranoid and regulated spaces in software development.
- danpalmer 3y ago
  I'm speaking from experience at Google, and honestly our software integrity processes are like nothing I could have imagined coming in. Not everything is perfect and it has clearly evolved over time, but basically for a modern internal Google codebase I don't think I could have much more trust that it is what it claims to be. I don't know if other big tech is quite the same, but from the little I've heard, I suspect that Microsoft, Amazon, Apple, and others in that ilk are similar. I'm very much in the camp of "trust but verify" here. You're right that Solar Winds was an utter disaster. It should never have been able to happen.
  - dv_dt 3y ago
    Microsoft has had some serious recent faults in their fundamental handling of a couple of areas (like driver signing! https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=37261500).
    - MaxBarraclough 3y ago
      And that's on top of Azure's recent appearance in the news. https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36979532 (Microsoft comes under blistering criticism for “grossly irresponsible” security)
- phillipcarter 3y ago
  Trusting "open source" is also how we get tons of other kinds of vulnerabilities, but that doesn't mean open source is unworthy of trust. The reason why organizations turn to other companies to deliver this is because there's a "throat to choke" for when things go wrong and a financial incentive to fix the inevitable issues when they come up.
- xinayder 3y ago
  To be honest when an attack like this happens at big companies, our expectations to mitigate the attack are much higher than if it's a project maintained by a small group of people. For example, Microsoft recently "lost" (they didn't disclose what happened) some sort of authentication key that allowed Chinese hackers to break into their network: https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/ https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern... How does this even happen at a big company like Microsoft? Then you take a look at small, <100 people company, their security policies are much more strict than Microsoft's. And even if it happened the same way, we wouldn't have such high expectations because they have a small team. Honestly, I prefer trusting a small project than a big company project. Take a look at Terraform now, HashiCorp pulled the plug and made it a proprietary app with source available requiring you to sign a CLA to prevent them from being sued later on. Red Hat is manipulating the GPL2 to force people to buy their subscriptions. EDIT: how can we forget how GitHub was before Microsoft bought it in 2016? GitHub was much more friendly to open source and nowadays they just use any open source code available on their service to train their Copilot AI without respecting the terms of the licenses of the millions of projects hosted there. They killed Atom. They scan your private and public repos for "vulnerabilities". They literally read everything on your repo and feed it into Copilot. If GitHub wasn't sold, I'm pretty sure the situation would be different. Call me crazy or dumb but I strongly believe that the bigger a company is, the worse their policies are. They neglect security at the cost of higher profits (ahem, looking at Facebook for allowing people to mine their users' data via an exploit that was just fixed when they called out Facebook for selling users' data).
fallat 3y ago
> There's basically no way to do this without trusting the redistributor in addition to the original publisher, but some things can reduce the amount of trust. Having a verifiable build process, that checks signing keys and hashes, that re-signs, etc, that all helps. If end-users can theoretically produce exactly the same build themselves it's easier to trust it. Really what much else could you ask for? It only takes 1 trusted friend to verify the codebase, and from there it can spread. Luckily there are a lot of talented people on the Internet whom several people can vouch for, easy to find. It's pretty much a non-problem in the age of the Internet. The same natural logic applies to anything else really... like cars - "yo what car do you trust?" It's just the nature of living. If you don't have the skills, you need to find someone who does to trust. And no just because it comes from a company doesn't mean you can trust it, that's a fallacy. "Safety" doesn't necessary equate to "profits" which is what a business needs to live. It's an organism.
- danpalmer 3y ago
  I'm certainly not equating safety to profits, but I think that a company such as Microsoft with decades of experience distributing cryptographically verified software to a range of demanding consumers (e.g. governments) and being big enough to be able to have teams running things like their certificate authority infrastructure, is much more likely to produce secure binary distributions than some GitHub Actions and shell scripts. I don't think your car analogy quite fits, as there are ongoing updates, and it's not like the end-user perception of regular VSCode, or backdoored VSCode, are going to be any different until someone spots the backdoor (and we can't rely on that).
  - yencabulator 3y ago
    Meanwhile in the real world, Microsoft is actively screwing up, losing control of their signing keys, failing to implementing even basics of Azure authentication, destroying Azure customer VM security, and so on. https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=28347141 https://news.ycombinator.com/item?id=28347141 https://news.ycombinator.com/item?id=28532531 https://news.ycombinator.com/item?id=28532531
Nullabillity 3y ago
The best option would have been for the source project to not be distributing malware in the first place.
deleted 3y ago
[deleted]
gustavus 3y ago
Ya I used to buy into that idea about using vendor products with the rationale that "at very least they wouldn't want to get sued for negligence so they have to have some basic security in place" then that huge bug came out where you got root access in Azure if you simply didn't send an AuthN header.
- justinhj 3y ago
  Well let’s not forget the importance of being able to sue. You use free software without warranty there is nobody to sue.
  - yencabulator 3y ago
    Good luck trying to sue Microsoft over a security vulnerability.
    - mcny 3y ago
      I think it is worth mentioning here that Microsoft does not care about user privacy. I don't know if this is because Microsoft took down the blog posts and press releases or because Google web search sucks now (different conversation) but I had trouble finding the source for Microsoft statement. I'm talking about the incident when Microsoft spied into a user's hotmail email contents. > However, to determine the identity of the leaker, CNET reveals, Microsoft actually looked through the Hotmail email of a French blogger who was in contact with the leaker, and make available online early copies of Windows 7 and Windows 8, as well as means that allowed users to circumvent activations protection for Microsoft and Windows. https://bgr.com/general/microsoft-hotmail-and-outlook-privacy/ https://bgr.com/general/microsoft-hotmail-and-outlook-privac... I wouldn't give Microsoft any benefit of the doubt. While I have utmost respect for the people (who I know and) who work there, the senior leadership has always been poopy at best. I would never trust a word they say.
  - Capricorn2481 3y ago
    "Yeah but you can sue" is not really that viable. How's that going for anybody? Not everyone can dedicate their time and savings to gambling on getting compensated. At the very least, the open source community is vigilant and quick to ostracize bad actors. Big tech companies get tax breaks to screw us over
wredue 3y ago
>big companies go to great lengths to ensure chain of trust lol.

sqeaky 3y ago

Trusting "big companies" because we presume they have guard rails seems like a bad idea, it is how we got the solar winds supply chain attack. When I worked for one of the largest voting machine companies I was astounded how the final build process for the software was done just before it was sent to the customer. It was built on a Jenkins server that several people had access to change and update with minimal oversight and the devops person had freedom to do anything to with no oversight. For the year I worked there this one man could have changed dozens of elections if he chose to and figuring it out would have been very hard. I am sure a large enough investigation could could have figured out such a thing, but by then the damage would already be done. If he changed only municipal elections that couldn't affors such an investigation it might never have been done. I have no reason to claim this happened, but we certainly can't prove it didn't and this is in one of the most paranoid and regulated spaces in software development.

danpalmer 3y ago
I'm speaking from experience at Google, and honestly our software integrity processes are like nothing I could have imagined coming in. Not everything is perfect and it has clearly evolved over time, but basically for a modern internal Google codebase I don't think I could have much more trust that it is what it claims to be. I don't know if other big tech is quite the same, but from the little I've heard, I suspect that Microsoft, Amazon, Apple, and others in that ilk are similar. I'm very much in the camp of "trust but verify" here. You're right that Solar Winds was an utter disaster. It should never have been able to happen.
- dv_dt 3y ago
  Microsoft has had some serious recent faults in their fundamental handling of a couple of areas (like driver signing! https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=37261500).
  - MaxBarraclough 3y ago
    And that's on top of Azure's recent appearance in the news. https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36979532 (Microsoft comes under blistering criticism for “grossly irresponsible” security)
phillipcarter 3y ago
Trusting "open source" is also how we get tons of other kinds of vulnerabilities, but that doesn't mean open source is unworthy of trust. The reason why organizations turn to other companies to deliver this is because there's a "throat to choke" for when things go wrong and a financial incentive to fix the inevitable issues when they come up.
xinayder 3y ago
To be honest when an attack like this happens at big companies, our expectations to mitigate the attack are much higher than if it's a project maintained by a small group of people. For example, Microsoft recently "lost" (they didn't disclose what happened) some sort of authentication key that allowed Chinese hackers to break into their network: https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/ https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern... How does this even happen at a big company like Microsoft? Then you take a look at small, <100 people company, their security policies are much more strict than Microsoft's. And even if it happened the same way, we wouldn't have such high expectations because they have a small team. Honestly, I prefer trusting a small project than a big company project. Take a look at Terraform now, HashiCorp pulled the plug and made it a proprietary app with source available requiring you to sign a CLA to prevent them from being sued later on. Red Hat is manipulating the GPL2 to force people to buy their subscriptions. EDIT: how can we forget how GitHub was before Microsoft bought it in 2016? GitHub was much more friendly to open source and nowadays they just use any open source code available on their service to train their Copilot AI without respecting the terms of the licenses of the millions of projects hosted there. They killed Atom. They scan your private and public repos for "vulnerabilities". They literally read everything on your repo and feed it into Copilot. If GitHub wasn't sold, I'm pretty sure the situation would be different. Call me crazy or dumb but I strongly believe that the bigger a company is, the worse their policies are. They neglect security at the cost of higher profits (ahem, looking at Facebook for allowing people to mine their users' data via an exploit that was just fixed when they called out Facebook for selling users' data).

fallat 3y ago

> There's basically no way to do this without trusting the redistributor in addition to the original publisher, but some things can reduce the amount of trust. Having a verifiable build process, that checks signing keys and hashes, that re-signs, etc, that all helps. If end-users can theoretically produce exactly the same build themselves it's easier to trust it. Really what much else could you ask for? It only takes 1 trusted friend to verify the codebase, and from there it can spread. Luckily there are a lot of talented people on the Internet whom several people can vouch for, easy to find. It's pretty much a non-problem in the age of the Internet. The same natural logic applies to anything else really... like cars - "yo what car do you trust?" It's just the nature of living. If you don't have the skills, you need to find someone who does to trust. And no just because it comes from a company doesn't mean you can trust it, that's a fallacy. "Safety" doesn't necessary equate to "profits" which is what a business needs to live. It's an organism.

danpalmer 3y ago
I'm certainly not equating safety to profits, but I think that a company such as Microsoft with decades of experience distributing cryptographically verified software to a range of demanding consumers (e.g. governments) and being big enough to be able to have teams running things like their certificate authority infrastructure, is much more likely to produce secure binary distributions than some GitHub Actions and shell scripts. I don't think your car analogy quite fits, as there are ongoing updates, and it's not like the end-user perception of regular VSCode, or backdoored VSCode, are going to be any different until someone spots the backdoor (and we can't rely on that).
- yencabulator 3y ago
  Meanwhile in the real world, Microsoft is actively screwing up, losing control of their signing keys, failing to implementing even basics of Azure authentication, destroying Azure customer VM security, and so on. https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=28347141 https://news.ycombinator.com/item?id=28347141 https://news.ycombinator.com/item?id=28532531 https://news.ycombinator.com/item?id=28532531

Nullabillity 3y ago

The best option would have been for the source project to not be distributing malware in the first place.

deleted 3y ago

[deleted]

gustavus 3y ago

Ya I used to buy into that idea about using vendor products with the rationale that "at very least they wouldn't want to get sued for negligence so they have to have some basic security in place" then that huge bug came out where you got root access in Azure if you simply didn't send an AuthN header.

justinhj 3y ago
Well let’s not forget the importance of being able to sue. You use free software without warranty there is nobody to sue.
- yencabulator 3y ago
  Good luck trying to sue Microsoft over a security vulnerability.
  - mcny 3y ago
    I think it is worth mentioning here that Microsoft does not care about user privacy. I don't know if this is because Microsoft took down the blog posts and press releases or because Google web search sucks now (different conversation) but I had trouble finding the source for Microsoft statement. I'm talking about the incident when Microsoft spied into a user's hotmail email contents. > However, to determine the identity of the leaker, CNET reveals, Microsoft actually looked through the Hotmail email of a French blogger who was in contact with the leaker, and make available online early copies of Windows 7 and Windows 8, as well as means that allowed users to circumvent activations protection for Microsoft and Windows. https://bgr.com/general/microsoft-hotmail-and-outlook-privacy/ https://bgr.com/general/microsoft-hotmail-and-outlook-privac... I wouldn't give Microsoft any benefit of the doubt. While I have utmost respect for the people (who I know and) who work there, the senior leadership has always been poopy at best. I would never trust a word they say.
- Capricorn2481 3y ago
  "Yeah but you can sue" is not really that viable. How's that going for anybody? Not everyone can dedicate their time and savings to gambling on getting compensated. At the very least, the open source community is vigilant and quick to ostracize bad actors. Big tech companies get tax breaks to screw us over

wredue 3y ago

>big companies go to great lengths to ensure chain of trust lol.