3 ms·
More personal observations: 8. Consumers are naive, yes. But the software industry itself is naive about the security threat. 9. The social exploit is part of
by heresie-dabord 3y ago
More personal observations:
8. Consumers are naive, yes. But the software industry itself is naive about the security threat.
9. The social exploit is part of the code exploit.
10. The FOSS axiom "More Eyes On The Code" works, but only if the "eyes" are educated. FOSS needs material support from industry. A MSFT engineer caught this exploit, but it still was released to G.A. in Fedora 41, openSUSE, and Kali.
11. The dev toolchain and testing process were never conceived to test for security. (edit: Also see Solarwinds [1] )
= = =
[1] _ https://www.wired.com/story/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever/ https://www.wired.com/story/the-untold-story-of-solarwinds-t...
- jbergknoff 3y ago> 10. The FOSS axiom "More Eyes On The Code" works, but only if the "eyes" are educated. One thing that could help with this is if somebody points an LLM at all these foundational repositories, prompted with "does this code change introduce any security issues?".
- andwoe 3y ago> "More Eyes On The Code" works That's the whole problem right there: lack of eyes on the code. If this code was actually maintained by more than one person, there's a high chance one of them would have caught on to it.