12 ms·

At first I thought it was paranoid to suggest that people on the linked thread might be complicit in the attack but then I read this message: > You ignore th

At first I thought it was paranoid to suggest that people on the linked thread might be complicit in the attack but then I read this message: > You ignore the many patches bit rotting away on this mailing list. Right now you choke your repo. Why wait until 5.4.0 to change maintainer? Why delay what your repo needs? It genuinely looks like we’re seeing a demonstration of supply chain psyops in retrospect. Amazing how sophisticated and patient this attack was.

jijijijij 3y ago
> It genuinely looks like we’re seeing a demonstration of supply chain psyops in retrospect. Worthwhile noting: It happened in the open, archived for the world to see at any time! The attacker needed to be extra careful not to raise suspicion, both acutely and for accumulated evidence in history. Of course, easy to say "Hindsight is 20/20", but we can probably agree in actual hindsight, we easily see a lot of suspicious acts around the issue. An individual incident may be chance, but as a whole things become clear more easily. So, I think there is a teachable moment here: When something seems just a tiny bit fishy, do a background check, investigate. You may not catch all something, but you probably won't miss everything. Now, looking at the level of sophistication and risk sneaking people and code into open infrastructure, imagine chances of getting caught infiltrating a large company writing closed source binary blobs for drivers, firmware, ...
- shp0ngle 3y ago
  There are not that many suspicious acts tbh. Randos complaining about unmaintained repos and unclosed issues is a constant in FOSS world. Sometimes it's even true, some projects really die and stop actually addressing real issues. But that's just inherent downside of the "bazaar" model. I don't think how we can "treat maintainers better" without going full corporate/without going full "cathedral".
  - transpute 3y ago
    > But that's just inherent downside of the "bazaar" model. I don't think how we can "treat maintainers better" without going full corporate/without going full "cathedral". We now have two decades of arms-race data in OSS projects influenced by ESR's paper [1]. At least one bazaar [2] has operated for centuries. Bazaars can develop decentralized responses to dynamic local threats. [1] http://www.catb.org/~esr/writings/cathedral-bazaar/ http://www.catb.org/~esr/writings/cathedral-bazaar/ [2] https://en.wikipedia.org/wiki/Grand_Bazaar,_Istanbul https://en.wikipedia.org/wiki/Grand_Bazaar,_Istanbul
kuschkufan 3y ago
Also the authors of these messages never interacted on that mailing list before or after. They only turned up to put pressure on the original maintainer.
asddubs 3y ago
this was two years ago though. why rush someone when you're planning to play the long game anyway?
- jrochkind1 3y ago
  Because successfully creating a sense of urgency will help the maintainer make a hurried unwise decision. It's part of the whole pattern.

jijijijij 3y ago

> It genuinely looks like we’re seeing a demonstration of supply chain psyops in retrospect. Worthwhile noting: It happened in the open, archived for the world to see at any time! The attacker needed to be extra careful not to raise suspicion, both acutely and for accumulated evidence in history. Of course, easy to say "Hindsight is 20/20", but we can probably agree in actual hindsight, we easily see a lot of suspicious acts around the issue. An individual incident may be chance, but as a whole things become clear more easily. So, I think there is a teachable moment here: When something seems just a tiny bit fishy, do a background check, investigate. You may not catch all something, but you probably won't miss everything. Now, looking at the level of sophistication and risk sneaking people and code into open infrastructure, imagine chances of getting caught infiltrating a large company writing closed source binary blobs for drivers, firmware, ...

shp0ngle 3y ago
There are not that many suspicious acts tbh. Randos complaining about unmaintained repos and unclosed issues is a constant in FOSS world. Sometimes it's even true, some projects really die and stop actually addressing real issues. But that's just inherent downside of the "bazaar" model. I don't think how we can "treat maintainers better" without going full corporate/without going full "cathedral".
- transpute 3y ago
  > But that's just inherent downside of the "bazaar" model. I don't think how we can "treat maintainers better" without going full corporate/without going full "cathedral". We now have two decades of arms-race data in OSS projects influenced by ESR's paper [1]. At least one bazaar [2] has operated for centuries. Bazaars can develop decentralized responses to dynamic local threats. [1] http://www.catb.org/~esr/writings/cathedral-bazaar/ http://www.catb.org/~esr/writings/cathedral-bazaar/ [2] https://en.wikipedia.org/wiki/Grand_Bazaar,_Istanbul https://en.wikipedia.org/wiki/Grand_Bazaar,_Istanbul

kuschkufan 3y ago

Also the authors of these messages never interacted on that mailing list before or after. They only turned up to put pressure on the original maintainer.

asddubs 3y ago

this was two years ago though. why rush someone when you're planning to play the long game anyway?

jrochkind1 3y ago
Because successfully creating a sense of urgency will help the maintainer make a hurried unwise decision. It's part of the whole pattern.