3 ms·

Trusting "big companies" because we presume they have guard rails seems like a bad idea, it is how we got the solar winds supply chain attack. When I worked fo

by sqeaky 3y ago

Trusting "big companies" because we presume they have guard rails seems like a bad idea, it is how we got the solar winds supply chain attack. When I worked for one of the largest voting machine companies I was astounded how the final build process for the software was done just before it was sent to the customer. It was built on a Jenkins server that several people had access to change and update with minimal oversight and the devops person had freedom to do anything to with no oversight. For the year I worked there this one man could have changed dozens of elections if he chose to and figuring it out would have been very hard. I am sure a large enough investigation could could have figured out such a thing, but by then the damage would already be done. If he changed only municipal elections that couldn't affors such an investigation it might never have been done. I have no reason to claim this happened, but we certainly can't prove it didn't and this is in one of the most paranoid and regulated spaces in software development.

danpalmer 3y ago
I'm speaking from experience at Google, and honestly our software integrity processes are like nothing I could have imagined coming in. Not everything is perfect and it has clearly evolved over time, but basically for a modern internal Google codebase I don't think I could have much more trust that it is what it claims to be. I don't know if other big tech is quite the same, but from the little I've heard, I suspect that Microsoft, Amazon, Apple, and others in that ilk are similar. I'm very much in the camp of "trust but verify" here. You're right that Solar Winds was an utter disaster. It should never have been able to happen.
- dv_dt 3y ago
  Microsoft has had some serious recent faults in their fundamental handling of a couple of areas (like driver signing! https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=37261500).
  - MaxBarraclough 3y ago
    And that's on top of Azure's recent appearance in the news. https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36979532 (Microsoft comes under blistering criticism for “grossly irresponsible” security)
phillipcarter 3y ago
Trusting "open source" is also how we get tons of other kinds of vulnerabilities, but that doesn't mean open source is unworthy of trust. The reason why organizations turn to other companies to deliver this is because there's a "throat to choke" for when things go wrong and a financial incentive to fix the inevitable issues when they come up.
xinayder 3y ago
To be honest when an attack like this happens at big companies, our expectations to mitigate the attack are much higher than if it's a project maintained by a small group of people. For example, Microsoft recently "lost" (they didn't disclose what happened) some sort of authentication key that allowed Chinese hackers to break into their network: https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/ https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern... How does this even happen at a big company like Microsoft? Then you take a look at small, <100 people company, their security policies are much more strict than Microsoft's. And even if it happened the same way, we wouldn't have such high expectations because they have a small team. Honestly, I prefer trusting a small project than a big company project. Take a look at Terraform now, HashiCorp pulled the plug and made it a proprietary app with source available requiring you to sign a CLA to prevent them from being sued later on. Red Hat is manipulating the GPL2 to force people to buy their subscriptions. EDIT: how can we forget how GitHub was before Microsoft bought it in 2016? GitHub was much more friendly to open source and nowadays they just use any open source code available on their service to train their Copilot AI without respecting the terms of the licenses of the millions of projects hosted there. They killed Atom. They scan your private and public repos for "vulnerabilities". They literally read everything on your repo and feed it into Copilot. If GitHub wasn't sold, I'm pretty sure the situation would be different. Call me crazy or dumb but I strongly believe that the bigger a company is, the worse their policies are. They neglect security at the cost of higher profits (ahem, looking at Facebook for allowing people to mine their users' data via an exploit that was just fixed when they called out Facebook for selling users' data).

by sqeaky 3y ago

danpalmer 3y ago

I'm speaking from experience at Google, and honestly our software integrity processes are like nothing I could have imagined coming in. Not everything is perfect and it has clearly evolved over time, but basically for a modern internal Google codebase I don't think I could have much more trust that it is what it claims to be. I don't know if other big tech is quite the same, but from the little I've heard, I suspect that Microsoft, Amazon, Apple, and others in that ilk are similar. I'm very much in the camp of "trust but verify" here. You're right that Solar Winds was an utter disaster. It should never have been able to happen.

dv_dt 3y ago
Microsoft has had some serious recent faults in their fundamental handling of a couple of areas (like driver signing! https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=37261500).
- MaxBarraclough 3y ago
  And that's on top of Azure's recent appearance in the news. https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36979532 (Microsoft comes under blistering criticism for “grossly irresponsible” security)

phillipcarter 3y ago

Trusting "open source" is also how we get tons of other kinds of vulnerabilities, but that doesn't mean open source is unworthy of trust. The reason why organizations turn to other companies to deliver this is because there's a "throat to choke" for when things go wrong and a financial incentive to fix the inevitable issues when they come up.

xinayder 3y ago

To be honest when an attack like this happens at big companies, our expectations to mitigate the attack are much higher than if it's a project maintained by a small group of people. For example, Microsoft recently "lost" (they didn't disclose what happened) some sort of authentication key that allowed Chinese hackers to break into their network: https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/ https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern... How does this even happen at a big company like Microsoft? Then you take a look at small, <100 people company, their security policies are much more strict than Microsoft's. And even if it happened the same way, we wouldn't have such high expectations because they have a small team. Honestly, I prefer trusting a small project than a big company project. Take a look at Terraform now, HashiCorp pulled the plug and made it a proprietary app with source available requiring you to sign a CLA to prevent them from being sued later on. Red Hat is manipulating the GPL2 to force people to buy their subscriptions. EDIT: how can we forget how GitHub was before Microsoft bought it in 2016? GitHub was much more friendly to open source and nowadays they just use any open source code available on their service to train their Copilot AI without respecting the terms of the licenses of the millions of projects hosted there. They killed Atom. They scan your private and public repos for "vulnerabilities". They literally read everything on your repo and feed it into Copilot. If GitHub wasn't sold, I'm pretty sure the situation would be different. Call me crazy or dumb but I strongly believe that the bigger a company is, the worse their policies are. They neglect security at the cost of higher profits (ahem, looking at Facebook for allowing people to mine their users' data via an exploit that was just fixed when they called out Facebook for selling users' data).