17 ms·
No thanks. That's not going to help, and will be fairly easy to circumvent for nation state actors or similar advanced persistent threats who will not have a p
by ulrikrasmussen 3y ago
No thanks.
That's not going to help, and will be fairly easy to circumvent for nation state actors or similar advanced persistent threats who will not have a problem adding an extra step of identity theft to their attack chain, or simply use an agent who can be protected if the backdoor is ever discovered.
On the other hand, the technical hoops required for something like that will likely cause a lot of damage to the whole open source community.
The solution here is learn from this attack and change practices to make a similar one more difficult to pull off:
1. Never allow files in release tar-balls which are not present in the repo.
2. As a consequence, all generated code should be checked in. Build scripts should re-generate all derived code and fail if the checked in code deviates from the generated.
3. No inscrutable data should be accessible by the release build process. This means that tests relying on binary data should be built completely separately from the release binaries.
- peteradio 3y agoStop trying to support such a variety of images too? Maybe?
- lenerdenator 3y agoIt's easy to steal or craft an identity. Having a person adopt that identity and use it over multiple in-person meetings around the world over an extended period of time is not. Part of the appeal of cyber operations for intelligence agencies is that there's basically no tradecraft involved. You park some hacker in front of a laptop within your territory (which also happens to have a constitution forbidding the extradition of citizens) and the hacker strikes at targets through obfuscated digital vectors of attack. They never go in public, they never get a photo taken of them, they never get trailed by counterintelligence. If you start telling people who want to be FLOSS repo maintainers that they'll need to be at a few in-person meetings over a span of two or three years if they want the keys to the project, that hacker has a much harder job, because in-person social engineering is hard. It has to be the same person showing up, time after time, and that person has to be able to talk the language of someone intimately familiar with the technology while being someone they're not. It's not a cure-all but for supply chain attacks, it makes the operation a lot riskier, resource-intense, and time-consuming.
- jpc0 3y agoMany OSS contributors likely don't have "fly to distant country for mandatory meeting" money. You are excluding a ton of contributors based on geography and income. It's not common that I find this line actually decent but check your privilege with this kind of comment. This is really a small step away from segregation.
- xcrunner529 3y agoThere are multiple ways to vet identity. Even just knowing location and such. This person used a VPN. A big red flag.