4 ms·

Everyone working on important open source code should have a real identity associated with them. The fact that "Jia Tan" was able to become a maintainer without

by brabel 3y ago

Everyone working on important open source code should have a real identity associated with them. The fact that "Jia Tan" was able to become a maintainer without anyone ever trying to figure out their real identity shows a huge weakness in our trust model in OSS (everyone real would have something like a Linked In page, Facebook, Twitter, Instagram, or better, their own website with stuff that could be used to ensure they're a real person - that could be faked as well but the amount of effort would be high, and checking this would be much better than just allowing effectively anonymous users to be maintainers - there's just no need for anonymity in this scenario!).

ninkendo 3y ago
> everyone real would have something like a Linked In page, Facebook, Twitter, Instagram, or better, their own website with stuff that could be used to ensure they're a real person Oof, I guess I’m not real then, as I have none of those things.
- ed_elliott_asc 3y ago
  Also this can all be faked
- SanitaryThinkin 3y ago
  On top of what you mentioned I also dislike the TSA-like response the OSS community is taking with this happen stance. I have anonomously contributed to many projects because I enjoy my privacy. All of my founding projects have also been done with anonymity. Because someone wants their anonmity and privacy does not mean they're nefarious, and I find it funny the group that takes to these principals most is negging on those ideas.
  - xign 3y ago
    Personally, I do find it hard to trust an open source project maintained by an anonymous person. (I'm talking about maintainership, not regular contributions that need to be code reviewed by another maintainer) I may toy around with them but I will probably not use them in a manner where I need to trust them continuously. It's totally cool for you to do whatever you want, since it's a free world after all, but if you want other people to use your code, then it's a two-way street no? Your code has a direct effect on their computers, and so they are placing their trust on you. You may value your privacy, but you need to balance that with other people's valuing their own security, and it's likely that whatever project you maintain may have an alternative as well. If you just want to commit some code and not have people use them then that's another issue altogether. I guess what I'm saying is: it's a two-way street. You can do things anonymously, but big companies / projects also don't have an obligation to use your code.
    - SanitaryThinkin 3y ago
      > You can do things anonymously, but big companies / projects also don't have an obligation to use your code. You're not wrong here, but I'm not forcing anyone to use my code bases or contributions. Also, think about how many systems you blindly trust on a daily basis. When you drive over a bridge, did you research the maitenance procedures and compliance was up to date? When you got a house or apartment, did you look into the engineering sign offs and construction companies? And that maitenance has been done up to snuff? Even down to hoping the inspector knows what they're doing? When you step into an elevator do you check the recent inspection plaque? When you get on an airplane are you aware of its maitenance history? And to further my point by refering back to the house example, did the company even QA the plane before they shipped it? And most importantly, did you check into whether the people actually did these things versus just saying they did them? What kind of trust does having a persons name attached to the project actually provide? I would argue its a psuedo-facade trust basis that gives a false sense of security. The truth of the matter is that you blindly trust millions of things on a daily basis. Including the very system you type from, which I guaruntee you has more than one anonymous maitainer attached to its underlying software. I totally get where you're coming from, but the same problems exist in every industry, supply, politics, every facet of your life is based on many blind trust principles. The one difference here with anonymous open source contributors is that they give you the code to read through yourself (and hope that you help ;) ) Very much unlike the proprietary software you're running beside it.
- nottorp 3y ago
  I have Facebook and the account and what's on it is no one's -ing business in a professional context.
  - ghaff 3y ago
    I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing but I also don't generally accept invites from people who are solely professional acquaintances or use it in a purely professional context at all.
    - nottorp 3y ago
      > I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing The age of self censorship :) I don't post anything on my FB. I'd still reject any employer who wanted to take a look.
      - ghaff 3y ago
        Self-censorship is probably a good thing in many cases. And there are certainly things I don't care to share in writing on any public or semi-public medium. But I agree that even if I can't keep an employer from sleuthing generally, I don't consider Facebook part of my professional record even if there's nothing on there I'd have a problem with a co-worker or potential co-worker seeing.
      - executesorder66 3y ago
        >> what's on it is no one's -ing business in a professional context. > The age of self censorship :) I find this amusing. I would also like to know what you hoped to achieve by self censoring the word fucking in your message above. - HN doesn't block posts with any kind of "profanity" filter - You didn't spare anyone from the profanity, since we all knew exactly what you were saying/thinking So I'm really curious what that actually achieved.
        nottorp 3y ago
iron-s 3y ago
What is real identity? Anything online can be faked. A state-issued id? How that protects against nation state?
- brabel 3y ago
  Nothing protects you if you're up against a state. That doesn't mean we should give up completely. Do you have a passport? That's a real identity in most places. Soon, it may be possible to use that to link your identity to a set of public keys which you can then use to identify yourself. There's a lot of work to be done to make this a reality, but work is surely going on right now and this is going to be possible one day. Check this out, as a starting point: https://curity.io/resources/learn/verifiable-credentials/ https://curity.io/resources/learn/verifiable-credentials/
reisse 3y ago
No-one working on open source code on their time owes anything to anyone using the code. If you want an important open source project to be maintaned by non-anonymous person, surprise-surprise, hire that person and pay them. Besides, some of the best open source contributors I know are almost-anonymous people behind nicknames and anime girls avatars.
- brabel 3y ago
  It is not about owing someone... it's about having provenance of code. If you're just an anonymous guy doing stuff for free and want to remain anonymous, that's fine, but then your software shouldn't be used by anyone who cares about toolchain attacks as there's just no way to trust you, and no way to verify every single commit you make on new releases. For software that gets used by many, which is a goal of OSS (otherwise just don't even bother to publish stuff, what's the point?), there needs to be a face behind it. I do agree with others that identity is a hard problem, but people here are pretending there's no solution to that (or misinterpreting what I wrote to mean people should have a Facebook or Twitter account, which is absolutely not what I was trying to say - I just mentioned the most popular websites real people are likely to be found on, as that could be used to prove their identity... for example, I have a Keybase account where my proof of identity, which is tied to my public keys, can be found on my GitHub profile - but they let you choose Facebook or Twitter for that purpose as well) when obviously there is. I should know, I work on this space.
  - reisse 3y ago
    > If you're just an anonymous guy doing stuff for free and want to remain anonymous, that's fine, but then your software shouldn't be used by anyone who cares about toolchain attacks as there's just no way to trust you, and no way to verify every single commit you make on new releases. What is, from security point of view, the difference between a toolchain attack performed by an anonymous contributor and by an identifiable real person? > For software that gets used by many, which is a goal of OSS It's not. The goal of OSS is to give users the possibility to study, change and improve the software. And that includes giving you ability to independently audit the code. All of that does not need any person behind it.
selfmodruntime 3y ago
Who are you to propose requirements onto people who work for free?
- brabel 3y ago
  I am not imposing anything on anyone. I am only saying that an OSS project that aims to be used as part of important infrastructure should impose at least some sort of identity vetoing and not just make random anonymous users maintainers of anything. If your project is not important and you don't care about any of this security stuff, feel free to continue publishing your untrustable projects.
the8472 3y ago
If you want security, pay for independent code audits (not compliance bullshit). Repeatedly. Don't offload your desires onto one-man-shows that the world decided are useful tools.
executesorder66 3y ago
News just in: NSA et al. defeated after having to create a LinkedIn and Instagram profile for their agents.
nottorp 3y ago
Why would I trust an "important open source project" with my identity? It goes both ways. Besides, the 'state actor' the security theater people keep mentioning would have no trouble creating such real identities.
- brabel 3y ago
  If you don't trust the project, you wouldn't contribute to it. The state actor may be able to fake identities, but that would still allow tracking the identity to a particular state... and if caught multiple times, that state would start losing credibility and projects may choose to stop trusting people from such nationality, unfortunately, or at least require more strong evidence the person is real and trustworthy if they come from known rogue nations.
  - nottorp 3y ago
    > If you don't trust the project, you wouldn't contribute to it. Trust them to merge a bugfix is different from trusting them with my identity isn't it? There are degrees of trust. For example I have a gmail address in my profile because the spam filter on there is better than what I have on my personal domain. People I've known for longer, business or otherwise, get the other (that I read more often).
MattPalmer1086 3y ago
None of those things prove identity. A well funded or just patient attacker can spoof all of those. Sure, it raises the bar a tiny bit, but it's no proof of identity.
tomn 3y ago
Yeah, it's not enforced (and certainly not with linked-in and facebook) but it's really not uncommon to require use of real names for contributions. Linux doesn't allow anonymous contributions: https://www.kernel.org/doc/html/latest/process/submitting-patches.html#developer-s-certificate-of-origin-1-1 https://www.kernel.org/doc/html/latest/process/submitting-pa... and this guide has been adopted by a lot of GPL-licensed projects (at least openwrt, glibc and gcc).
- ghaff 3y ago
  I'm not sure why the downvotes. That seems to be a statement of fact. You can do a certain amount of identity obfuscation online but for anyone with a real professional profile you're generally not really anonymous if anyone really cares to find out your true name.
  - tomn 3y ago
    Me neither, i even provided a source, and it's easy to find other examples. There certainly are projects that allow anonymous contributions, but i doubt it's the majority of projects that one would consider important. For these kinds of projects you could make up an identity relatively easily and nobody would know, but you're screwing over the project (as they may need to remove your contributions if they find out), so it's not something to be doing if you actually want to contribute (instead of inserting backdoors). The original idea (not being able to contribute without a verified identity) is still wrong, but it's wrong because it's impractical to prove identity in a way that people find acceptable (and works), not because people will not give up anonymity, as many of the replies state.
    - ghaff 3y ago
      There are people who downvote things that present facts that aren't in accordance with how they think the world should be. I do think it's difficult to verify identity in any reasonably acceptable lightweight way. That said, for the larger projects I'm most familiar with, a lot of people work for companies, attend conferences, etc. They may go by nicknames day to day, but they have known real identities and their professional existence wouldn't be possible without one.
acdha 3y ago
> everyone real would have something like a Linked In page, Facebook, Twitter, Instagram, or better, their own website with stuff that could be used to ensure they're a real person Have you seen the campaigns people have run building fake LinkedIn profiles and slowly adding “connections”? There was one a few years ago which roped in a lot infosec people who should have known better and it’s gotten much worse with AI generators. Even before LLMs what you described would have been a godsend for intelligence agencies - who has more time for it, an open source developer writing actual code or the dedicated social media team at the IRA? – and now that’s increasingly worse.
- brabel 3y ago
  I believe the solution to identity on the Internet needs to be tied to governments, that's unfortunate but in real life, that's always been the case and I can see no alternative here. Blockchain is a pipedream and no serious work is going to associate a person's identity to a key which cannot be revoked, cannot be recovered in case of "loss", can be tracked on a public ledger etc. etc... But there's actual good work going on in the identity industry, like Verifiable Credentials, so this will become a reality soon: you will be able to verify someone's identity as long as you trust the issuer of their "credential" (which in the case here would mean basically a username and a public key or reference to a JWKS which can be used to verify the signature of the person, very much like the digital version of an identity card which can be used to check the signature on some piece of paper, but actually cyptographically safe)... so you would need to add a few governments to your list of "approved issuers", or something more indirect like universities (which themselves would rely on the government-issued identity) or traffic authorities (if you rely on driving licenses). Sure, Governments can lie, and people go to great lengths to steal others' identities in real life, but in the current world, we're still able to get bank accounts, passports etc. based on this model... just because the system is not perfect doesnt' mean it's not good enough, specially when there's no better alternative at all.

by brabel 3y ago

ninkendo 3y ago

ed_elliott_asc 3y ago
Also this can all be faked
SanitaryThinkin 3y ago
On top of what you mentioned I also dislike the TSA-like response the OSS community is taking with this happen stance. I have anonomously contributed to many projects because I enjoy my privacy. All of my founding projects have also been done with anonymity. Because someone wants their anonmity and privacy does not mean they're nefarious, and I find it funny the group that takes to these principals most is negging on those ideas.
- xign 3y ago
  Personally, I do find it hard to trust an open source project maintained by an anonymous person. (I'm talking about maintainership, not regular contributions that need to be code reviewed by another maintainer) I may toy around with them but I will probably not use them in a manner where I need to trust them continuously. It's totally cool for you to do whatever you want, since it's a free world after all, but if you want other people to use your code, then it's a two-way street no? Your code has a direct effect on their computers, and so they are placing their trust on you. You may value your privacy, but you need to balance that with other people's valuing their own security, and it's likely that whatever project you maintain may have an alternative as well. If you just want to commit some code and not have people use them then that's another issue altogether. I guess what I'm saying is: it's a two-way street. You can do things anonymously, but big companies / projects also don't have an obligation to use your code.
  - SanitaryThinkin 3y ago
    > You can do things anonymously, but big companies / projects also don't have an obligation to use your code. You're not wrong here, but I'm not forcing anyone to use my code bases or contributions. Also, think about how many systems you blindly trust on a daily basis. When you drive over a bridge, did you research the maitenance procedures and compliance was up to date? When you got a house or apartment, did you look into the engineering sign offs and construction companies? And that maitenance has been done up to snuff? Even down to hoping the inspector knows what they're doing? When you step into an elevator do you check the recent inspection plaque? When you get on an airplane are you aware of its maitenance history? And to further my point by refering back to the house example, did the company even QA the plane before they shipped it? And most importantly, did you check into whether the people actually did these things versus just saying they did them? What kind of trust does having a persons name attached to the project actually provide? I would argue its a psuedo-facade trust basis that gives a false sense of security. The truth of the matter is that you blindly trust millions of things on a daily basis. Including the very system you type from, which I guaruntee you has more than one anonymous maitainer attached to its underlying software. I totally get where you're coming from, but the same problems exist in every industry, supply, politics, every facet of your life is based on many blind trust principles. The one difference here with anonymous open source contributors is that they give you the code to read through yourself (and hope that you help ;) ) Very much unlike the proprietary software you're running beside it.
nottorp 3y ago
I have Facebook and the account and what's on it is no one's -ing business in a professional context.
- ghaff 3y ago
  I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing but I also don't generally accept invites from people who are solely professional acquaintances or use it in a purely professional context at all.
  - nottorp 3y ago
    > I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing The age of self censorship :) I don't post anything on my FB. I'd still reject any employer who wanted to take a look.
    - ghaff 3y ago
      Self-censorship is probably a good thing in many cases. And there are certainly things I don't care to share in writing on any public or semi-public medium. But I agree that even if I can't keep an employer from sleuthing generally, I don't consider Facebook part of my professional record even if there's nothing on there I'd have a problem with a co-worker or potential co-worker seeing.
    - executesorder66 3y ago
      >> what's on it is no one's -ing business in a professional context. > The age of self censorship :) I find this amusing. I would also like to know what you hoped to achieve by self censoring the word fucking in your message above. - HN doesn't block posts with any kind of "profanity" filter - You didn't spare anyone from the profanity, since we all knew exactly what you were saying/thinking So I'm really curious what that actually achieved.
      - nottorp 3y ago

iron-s 3y ago

What is real identity? Anything online can be faked. A state-issued id? How that protects against nation state?

brabel 3y ago
Nothing protects you if you're up against a state. That doesn't mean we should give up completely. Do you have a passport? That's a real identity in most places. Soon, it may be possible to use that to link your identity to a set of public keys which you can then use to identify yourself. There's a lot of work to be done to make this a reality, but work is surely going on right now and this is going to be possible one day. Check this out, as a starting point: https://curity.io/resources/learn/verifiable-credentials/ https://curity.io/resources/learn/verifiable-credentials/

reisse 3y ago

No-one working on open source code on their time owes anything to anyone using the code. If you want an important open source project to be maintaned by non-anonymous person, surprise-surprise, hire that person and pay them. Besides, some of the best open source contributors I know are almost-anonymous people behind nicknames and anime girls avatars.

brabel 3y ago
It is not about owing someone... it's about having provenance of code. If you're just an anonymous guy doing stuff for free and want to remain anonymous, that's fine, but then your software shouldn't be used by anyone who cares about toolchain attacks as there's just no way to trust you, and no way to verify every single commit you make on new releases. For software that gets used by many, which is a goal of OSS (otherwise just don't even bother to publish stuff, what's the point?), there needs to be a face behind it. I do agree with others that identity is a hard problem, but people here are pretending there's no solution to that (or misinterpreting what I wrote to mean people should have a Facebook or Twitter account, which is absolutely not what I was trying to say - I just mentioned the most popular websites real people are likely to be found on, as that could be used to prove their identity... for example, I have a Keybase account where my proof of identity, which is tied to my public keys, can be found on my GitHub profile - but they let you choose Facebook or Twitter for that purpose as well) when obviously there is. I should know, I work on this space.
- reisse 3y ago
  > If you're just an anonymous guy doing stuff for free and want to remain anonymous, that's fine, but then your software shouldn't be used by anyone who cares about toolchain attacks as there's just no way to trust you, and no way to verify every single commit you make on new releases. What is, from security point of view, the difference between a toolchain attack performed by an anonymous contributor and by an identifiable real person? > For software that gets used by many, which is a goal of OSS It's not. The goal of OSS is to give users the possibility to study, change and improve the software. And that includes giving you ability to independently audit the code. All of that does not need any person behind it.

selfmodruntime 3y ago

Who are you to propose requirements onto people who work for free?

brabel 3y ago
I am not imposing anything on anyone. I am only saying that an OSS project that aims to be used as part of important infrastructure should impose at least some sort of identity vetoing and not just make random anonymous users maintainers of anything. If your project is not important and you don't care about any of this security stuff, feel free to continue publishing your untrustable projects.

the8472 3y ago

If you want security, pay for independent code audits (not compliance bullshit). Repeatedly. Don't offload your desires onto one-man-shows that the world decided are useful tools.

executesorder66 3y ago

News just in: NSA et al. defeated after having to create a LinkedIn and Instagram profile for their agents.

nottorp 3y ago

Why would I trust an "important open source project" with my identity? It goes both ways. Besides, the 'state actor' the security theater people keep mentioning would have no trouble creating such real identities.

brabel 3y ago
If you don't trust the project, you wouldn't contribute to it. The state actor may be able to fake identities, but that would still allow tracking the identity to a particular state... and if caught multiple times, that state would start losing credibility and projects may choose to stop trusting people from such nationality, unfortunately, or at least require more strong evidence the person is real and trustworthy if they come from known rogue nations.
- nottorp 3y ago
  > If you don't trust the project, you wouldn't contribute to it. Trust them to merge a bugfix is different from trusting them with my identity isn't it? There are degrees of trust. For example I have a gmail address in my profile because the spam filter on there is better than what I have on my personal domain. People I've known for longer, business or otherwise, get the other (that I read more often).

MattPalmer1086 3y ago

None of those things prove identity. A well funded or just patient attacker can spoof all of those. Sure, it raises the bar a tiny bit, but it's no proof of identity.

tomn 3y ago

Yeah, it's not enforced (and certainly not with linked-in and facebook) but it's really not uncommon to require use of real names for contributions. Linux doesn't allow anonymous contributions: https://www.kernel.org/doc/html/latest/process/submitting-patches.html#developer-s-certificate-of-origin-1-1 https://www.kernel.org/doc/html/latest/process/submitting-pa... and this guide has been adopted by a lot of GPL-licensed projects (at least openwrt, glibc and gcc).

ghaff 3y ago
I'm not sure why the downvotes. That seems to be a statement of fact. You can do a certain amount of identity obfuscation online but for anyone with a real professional profile you're generally not really anonymous if anyone really cares to find out your true name.
- tomn 3y ago
  Me neither, i even provided a source, and it's easy to find other examples. There certainly are projects that allow anonymous contributions, but i doubt it's the majority of projects that one would consider important. For these kinds of projects you could make up an identity relatively easily and nobody would know, but you're screwing over the project (as they may need to remove your contributions if they find out), so it's not something to be doing if you actually want to contribute (instead of inserting backdoors). The original idea (not being able to contribute without a verified identity) is still wrong, but it's wrong because it's impractical to prove identity in a way that people find acceptable (and works), not because people will not give up anonymity, as many of the replies state.
  - ghaff 3y ago
    There are people who downvote things that present facts that aren't in accordance with how they think the world should be. I do think it's difficult to verify identity in any reasonably acceptable lightweight way. That said, for the larger projects I'm most familiar with, a lot of people work for companies, attend conferences, etc. They may go by nicknames day to day, but they have known real identities and their professional existence wouldn't be possible without one.

acdha 3y ago

> everyone real would have something like a Linked In page, Facebook, Twitter, Instagram, or better, their own website with stuff that could be used to ensure they're a real person Have you seen the campaigns people have run building fake LinkedIn profiles and slowly adding “connections”? There was one a few years ago which roped in a lot infosec people who should have known better and it’s gotten much worse with AI generators. Even before LLMs what you described would have been a godsend for intelligence agencies - who has more time for it, an open source developer writing actual code or the dedicated social media team at the IRA? – and now that’s increasingly worse.

brabel 3y ago
I believe the solution to identity on the Internet needs to be tied to governments, that's unfortunate but in real life, that's always been the case and I can see no alternative here. Blockchain is a pipedream and no serious work is going to associate a person's identity to a key which cannot be revoked, cannot be recovered in case of "loss", can be tracked on a public ledger etc. etc... But there's actual good work going on in the identity industry, like Verifiable Credentials, so this will become a reality soon: you will be able to verify someone's identity as long as you trust the issuer of their "credential" (which in the case here would mean basically a username and a public key or reference to a JWKS which can be used to verify the signature of the person, very much like the digital version of an identity card which can be used to check the signature on some piece of paper, but actually cyptographically safe)... so you would need to add a few governments to your list of "approved issuers", or something more indirect like universities (which themselves would rely on the government-issued identity) or traffic authorities (if you rely on driving licenses). Sure, Governments can lie, and people go to great lengths to steal others' identities in real life, but in the current world, we're still able to get bank accounts, passports etc. based on this model... just because the system is not perfect doesnt' mean it's not good enough, specially when there's no better alternative at all.