3 ms·

> It genuinely looks like we’re seeing a demonstration of supply chain psyops in retrospect. Worthwhile noting: It happened in the open, archived for the world

> It genuinely looks like we’re seeing a demonstration of supply chain psyops in retrospect. Worthwhile noting: It happened in the open, archived for the world to see at any time! The attacker needed to be extra careful not to raise suspicion, both acutely and for accumulated evidence in history. Of course, easy to say "Hindsight is 20/20", but we can probably agree in actual hindsight, we easily see a lot of suspicious acts around the issue. An individual incident may be chance, but as a whole things become clear more easily. So, I think there is a teachable moment here: When something seems just a tiny bit fishy, do a background check, investigate. You may not catch all something, but you probably won't miss everything. Now, looking at the level of sophistication and risk sneaking people and code into open infrastructure, imagine chances of getting caught infiltrating a large company writing closed source binary blobs for drivers, firmware, ...

shp0ngle 3y ago
There are not that many suspicious acts tbh. Randos complaining about unmaintained repos and unclosed issues is a constant in FOSS world. Sometimes it's even true, some projects really die and stop actually addressing real issues. But that's just inherent downside of the "bazaar" model. I don't think how we can "treat maintainers better" without going full corporate/without going full "cathedral".
- transpute 3y ago
  > But that's just inherent downside of the "bazaar" model. I don't think how we can "treat maintainers better" without going full corporate/without going full "cathedral". We now have two decades of arms-race data in OSS projects influenced by ESR's paper [1]. At least one bazaar [2] has operated for centuries. Bazaars can develop decentralized responses to dynamic local threats. [1] http://www.catb.org/~esr/writings/cathedral-bazaar/ http://www.catb.org/~esr/writings/cathedral-bazaar/ [2] https://en.wikipedia.org/wiki/Grand_Bazaar,_Istanbul https://en.wikipedia.org/wiki/Grand_Bazaar,_Istanbul

shp0ngle 3y ago

There are not that many suspicious acts tbh. Randos complaining about unmaintained repos and unclosed issues is a constant in FOSS world. Sometimes it's even true, some projects really die and stop actually addressing real issues. But that's just inherent downside of the "bazaar" model. I don't think how we can "treat maintainers better" without going full corporate/without going full "cathedral".

transpute 3y ago
> But that's just inherent downside of the "bazaar" model. I don't think how we can "treat maintainers better" without going full corporate/without going full "cathedral". We now have two decades of arms-race data in OSS projects influenced by ESR's paper [1]. At least one bazaar [2] has operated for centuries. Bazaars can develop decentralized responses to dynamic local threats. [1] http://www.catb.org/~esr/writings/cathedral-bazaar/ http://www.catb.org/~esr/writings/cathedral-bazaar/ [2] https://en.wikipedia.org/wiki/Grand_Bazaar,_Istanbul https://en.wikipedia.org/wiki/Grand_Bazaar,_Istanbul