4 ms·
GitHub Disabled the Xz Repo
- chris_wot 3y agoWhy?
- TehCorwiz 3y agoThe fallout from this: https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810 Turns out one of the newer maintainers of the library managed to get a backdoor into it.
- manyturtles 3y agoSee https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810
- Dylan16807 3y agoI don't think that answers why. It's the cause, but the logic is missing.
- ncr100 3y agoMaybe GH expects a force push of older, trusted xv versions has/will happen. Makes this repo untrustworthy.
- Repulsion9513 3y agoThere's a few obvious reasons - It's disguised malware which they probably don't want to host (even if it's widely reported, not everyone will have heard). It's probably significantly easier to disable the repo than for them to roll it back - and even if they wanted to roll it back it's not clear where to roll back to, and introduces more confusion. - They were probably getting a continuous stream of reports regarding the repo. - The repo was generating a continuous stream of "lol wow" comments on every object in it regarding the situation. - They are probably concerned about fallout towards their reputation. - No one has a pressing need to access the repo. You can't safely use the code from it etc. I'm sure someone will upload it somewhere for study soon enough. (Preferably in such a way that it's obviously to be treated as malware) - The most likely scenario is that momentum will gather around a fork which will be a different URL anyway...
- yread 3y agoIt could also be evidence in a criminal investigation
- 1attice 3y agoWell, there goes `nixos-unstable`
- nextaccountic 3y agoPulling directly from github is probably not a good thing either way. Maybe nixos should have its own mirror. Or maybe there should be an ipfs mirror that some distros and other projects could seed Anyway I think that a new release that fixes the known vuln isn't enough. There should be a release without all contributions from the malicious dude
- deleted 3y ago[deleted]
- rurban 3y agoPulling directly from github is the good thing. The release tar was compromised, the sources not.
- nextaccountic 3y agoIn this specific case this is true, but generally speaking Github can remove repositories for any reason (and for no reason). They provide free bandwidth so it gets used for that, it's just not trustworthy. One option for distros that compile from source (such as Gentoo, NixOS without the package cache, of Arch Linux's AUR) is to make the package system to either download from Github, or download from a distro-provided mirror if Github is down. Distros could pool together to offer a source code mirror that is common for all their users. That would be a good thing.
- 1attice 3y agoLess puckishly: in general, as a movement/culture/economic ferment, we probably should have been more hesitant to introduce a de-facto single-point-of-failure into, like, all the things. I mean, nothing _mandates_ that NixOS packages pull their source from github (or any other git hoster) but the standard practice is basically just this. The nix cache will prevent the impact from this specific disablement from being, well, disabling, for most folks most of the time, for a while at least, but caching, by definition, is ephemeral storage, and sooner or later, it, ah, ephemes? Is that a word? There are also a lot of packages that have to be built locally, e.g. nonfree packages like nvidia drivers; at least _one_ of these packages (how popular? how critical?) will probably fail to build on this account, and this in turn will cause a certain (unknown) quotient of misery. Somewhere, some lights are going out. (How many? How soon? With what mitigation?) Anyway. Nix is obviously not the only product to rely on github as a de facto backing store, so
- hgs3 3y agoIs disabling the compromised repo the typical GitHub policy? My concern is there are monorepos used by package managers, like brew, that are a collection of thousands of projects [1]. These monorepos seem like a prime target for attack and if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem. [1] https://github.com/Homebrew/homebrew-core https://github.com/Homebrew/homebrew-core
- gertop 3y ago> if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem. Maybe that should be an opportunity for introspection into the house of card we've collectively built as software engineers.
- raincole 3y agoMaybe Github should at least move it to a new URL so people can learn from this security case first hand.
- kelnos 3y agoMaybe we shouldn't rely on a corporation owned by Microsoft (of all companies, jeez) for essential parts of our open-source infrastructure.
- J-Kuhn 3y agoWe know that we build a house out of cards: https://xkcd.com/2347/ https://xkcd.com/2347/
- onionisafruit 3y agoIt’s been a few years since I worked there, but I suspect situations like this are still played by ear. They may have run books for it now, but I think human judgement is still a significant factor.
- soneil 3y agoI don't think the situation is very typical, so I don't why the response should be. There's two maintainers, one is on an "internet hiatus", the other is either suspected of being the bad actor, or is otherwise so thoroughly compromised to destroy any short-term trust. I assume if homebrew had such an egregious issue, they'd have someone able to respond to it.
- blahgeek 3y agoI don't understand the significance of this link. It's some random people saying the title. Why not link to the github repo?
- Dylan16807 3y agoHN really doesn't like editorialized titles. And the repo title wouldn't mention the news. Maybe it would be allowed in this case, but a tweet or similar is safer.
- Repulsion9513 3y ago> Please submit the original source. If a post reports on something found on another site, submit the latter. So: submit the GitHub link > Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize. So: use what the link says, which in this case might perhaps be "xz repository has been disabled by GitHub"
- dec0dedab0de 3y agoAgreed, This link is a little bit better since it includes other discussion, but I believe it already had an HN thread https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27?permalink_comment_id=5005917#gistcomment-5005917 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b...
- az09mugen 3y agoYou're right, but maybe because there's nothing to see : https://github.com/tukaani-project/xz https://github.com/tukaani-project/xz
- noncoml 3y agoI guess it’s only temporary u until they find a new owner, but they should have made it read only to avoid breaking whatever depends on xz code to be there.
- barkingcat 3y agoxz is also used in Windows and who knows what versions or how it is used there (impossible to verify because of the closed source nature of the windows ecosystem) if Microsoft security detected some kind of relations between xz and exploits injected into the Windows source code/build process, they are pretty much 100% going to order github to nuke the entire repo regardless of what other people in the open source community thinks or wants. https://en.wikipedia.org/wiki/XZ_Utils https://en.wikipedia.org/wiki/XZ_Utils
- deleted 3y ago[deleted]
- WireBuffalo 3y agoDoes anyone have a clone available for historical / analysis purposes? I understand Microsoft doesn't want to participate in being a further attack vector - ie. "what if people use github to revert to a prior version that secretly had another vulnerability?" But removing public access to the repository prevents the community and industry analysis that would identify those prior vulnerabilities.
- AverseABFun 3y agoSeconding this; Made a ycombinator account solely to say this.
- AverseABFun 3y agoUpdate: found a repo(thanks to @ar-jan on GitHub), https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/tukaani-project/xz https://archive.softwareheritage.org/browse/origin/directory...
- hyperswine 3y agoOne hell of a social engineering attack