4 ms·

While the article does present both sides of the classic open source debate ("It's vulnerable because it's open" vs. "It's safe because so many eyes are on it")

by cvoss 3y ago

While the article does present both sides of the classic open source debate ("It's vulnerable because it's open" vs. "It's safe because so many eyes are on it"), it seems to come down on the side of the former. Typical non-software-engineering readers may take away the notion that they should trust open source software less, try to not to rely on it, and become frustrated by the realization that that's almost entirely out of their control as a layperson. But typical software-engineering readers should take away the notion that they, too, should trust open source software less, and, as a solution, rather than withdraw from it, they should become more invested in its thesis of security through the wisdom of crowds. The article quotes someone pooh-poohing "hobbyist" maintainers. But just because something is your hobby doesn't mean you're not a professional at it. Just because you don't get paid for it doesn't mean it's not an incredibly valuable part of your contribution to the good of your neighbors. Keep up the excellent work, everyone. I hope the xz lesson is one that moves us toward the ideal of open source, not away from it.

zeroCalories 3y ago
A crowd is also easy to hide in if it's not actually watching things closely. I expect the actual solution is that we move to sponsored open source, closed contribution projects. No way can we depend on the C equivalent of a random nodejs package for our most important infrastructure.
- deleted 3y ago
  [deleted]
- mulmen 3y ago
  How do you know you can trust the contributors?
  - xcrunner529 3y ago
    Need to start doing basic verification of identity, being suspicious of users always using a VPn and proving their real location, many many years of contributions before becoming a maintainer and having that control etc.
    - zeroCalories 3y ago
      This. Most important contributors are employed by big tech anyway. If you're an independent contributor at the minimum we need to have a way to hold you accountable.
      - porkbeer 3y ago
        Siloing it back to big tech just creates the same problem again, because they have no incentive to keep it open.
        AstralStorm 3y ago
        It's not siloed, the problem becomes one of trusting Microsoft with your address data. Then them verifying it correctly (which they won't) Then on maintainer checking if they're giving ownership to the right person. And just like everyone else, these have been compromised before.
      - xcrunner529 3y ago
        Funny thing is other services such as banks and even Tinder (!) are way better at automatically not trusting and even demoting VPN users. Perhaps GitHub and others should do better here with making that stuff more visible. Oh and it appears the dev was working via email rather than the mailing list for a bit too. Probably should be more suspicious of any back channel attempts like that too.
jdsalaro 3y ago
> Just because you don't get paid for it doesn't mean it's not an incredibly valuable part of your contribution to the good of your neighbors. Keep up the excellent work, everyone. Precisely, I truly do not understand how these people witness a potentially catastrophic event of such proportions and instead of asking "dear God, I wonder how many backdoors there are in the Windows operating system that we don't know and will never find out about!?! Thankfully Linux and its ecosystem can be somewhat audited!". Instead they go full blown "please make it go away, if it's visible by us it means it's terrible and dangerous! FOSS is insecure!" I've said it once[1] and I'll say it again: FOSS delivered both on its pitfalls and its strengths. Moreover, and I'll never get tired of repeating this: Although this might be indeed a FOSS-exclusive or FOSS-adjacent kind of risk that ultimately materialized, as some would like to call it, it’s nevertheless also an issue where checks and balances that are only intrinsically possible in FOSS worked as expected and needed. Yes, there was an element of luck in the discovery of CVE-20240-3094, but it is undeniable source code availability and other FOSS customs tipped the scale in the community’s favor. [1] https://jdsalaro.com/note/xz-liblzma-linux-backdoor-foss-pitfalls-strengths https://jdsalaro.com/note/xz-liblzma-linux-backdoor-foss-pit...
- TZubiri 3y ago
  But open sourceness in no way contributed to this being found, it was not in the source code. If something like this happened in windows, it could be found in the same way, and the culprit could be identified and charged with crimes. Just take the L for FOSS instead of trying a UNO reverse card
  - jdsalaro 3y ago
    [flagged]
  - wolverine876 3y ago
    > But open sourceness in no way contributed to this being found, it was not in the source code. Where was it? The explanation I saw included obsfucated code. ?
wolverine876 3y ago
I've now seen four articles in a range of publications using the xz incident to say that same thing about FOSS. Here's one in a defense industry publication: https://www.defenseone.com/ideas/2024/04/how-fix-militarys-software-snafu/395489/ https://www.defenseone.com/ideas/2024/04/how-fix-militarys-s... When it appears in diverse multiple places simultaneously, I generally believe someone is coordinating a media campaign. You may think that's paranoid but look at the merits of the argument: how else is it explained? They didn't coincidentally think of the exact same argument, especially when FOSS's reputation has been well-established for a long time - why now, for this particiular vulnerability, are all these people suddenly expressing doubts? And they didn't read each other's articles: these articles need to be thought of, written, edited, and published. You (those reading on HN) needs to push back and point out the absurdity of the argument now. Otherwise, even if it doesn't cause major changes, it will plant a seed - FUD, using the old IBM technique. Next time there's a incident, they will just keep beating that drum, as for-profit companies make another reach for more power. I'm sure others here will point out plenty of flaws in the argument; biggest of all is that proprietary software has the same problems - you can list them with ease. Who is behind it? We may know when the first one says they are discontinuing using FOSS. EDIT: Another reason to think it's coordinated: It's absolute BS. Nobody in IT would seriously make this claim. Everyone uses FOSS one way or another, and everyone has seen plenty of awful proprietary software. It's a deception intended for the uninformed outside IT. Think about it: Many people saying the truth simultaneously makes sense. But for many people to come up with the same BS - and any IT professional is deceiving people knowingly - that takes coordination.
- kibwen 3y ago
  > I generally believe someone is coordinating a media campaign. You don't need centralized coordination. Companies that sell closed-source software are inherently incentivized to defend their practices and denigrate their competitors. It's not a cabal, it's the systematic perverse incentives created by financial interests.
  - wolverine876 3y ago
    Why haven't I seen that argument previously when there were vulnerabilities? Why are all these people suddenly saying it, all at the same time?
BlueTemplar 3y ago
> But just because something is your hobby doesn't mean you're not a professional at it. While I do understand how you use that word here, it literally does, and it does in the general case because of incentives. (Thankfully, exceptional people that rise above this do exist, but hopefully we'll find a way to do better than basically using martyrs.)
intelVISA 3y ago
at least with Windows the backdoors are obscured from my immediate view!!

by cvoss 3y ago

zeroCalories 3y ago

A crowd is also easy to hide in if it's not actually watching things closely. I expect the actual solution is that we move to sponsored open source, closed contribution projects. No way can we depend on the C equivalent of a random nodejs package for our most important infrastructure.

deleted 3y ago
[deleted]
mulmen 3y ago
How do you know you can trust the contributors?
- xcrunner529 3y ago
  Need to start doing basic verification of identity, being suspicious of users always using a VPn and proving their real location, many many years of contributions before becoming a maintainer and having that control etc.
  - zeroCalories 3y ago
    This. Most important contributors are employed by big tech anyway. If you're an independent contributor at the minimum we need to have a way to hold you accountable.
    - porkbeer 3y ago
      Siloing it back to big tech just creates the same problem again, because they have no incentive to keep it open.
      - AstralStorm 3y ago
        It's not siloed, the problem becomes one of trusting Microsoft with your address data. Then them verifying it correctly (which they won't) Then on maintainer checking if they're giving ownership to the right person. And just like everyone else, these have been compromised before.
    - xcrunner529 3y ago
      Funny thing is other services such as banks and even Tinder (!) are way better at automatically not trusting and even demoting VPN users. Perhaps GitHub and others should do better here with making that stuff more visible. Oh and it appears the dev was working via email rather than the mailing list for a bit too. Probably should be more suspicious of any back channel attempts like that too.

jdsalaro 3y ago

> Just because you don't get paid for it doesn't mean it's not an incredibly valuable part of your contribution to the good of your neighbors. Keep up the excellent work, everyone. Precisely, I truly do not understand how these people witness a potentially catastrophic event of such proportions and instead of asking "dear God, I wonder how many backdoors there are in the Windows operating system that we don't know and will never find out about!?! Thankfully Linux and its ecosystem can be somewhat audited!". Instead they go full blown "please make it go away, if it's visible by us it means it's terrible and dangerous! FOSS is insecure!" I've said it once[1] and I'll say it again: FOSS delivered both on its pitfalls and its strengths. Moreover, and I'll never get tired of repeating this: Although this might be indeed a FOSS-exclusive or FOSS-adjacent kind of risk that ultimately materialized, as some would like to call it, it’s nevertheless also an issue where checks and balances that are only intrinsically possible in FOSS worked as expected and needed. Yes, there was an element of luck in the discovery of CVE-20240-3094, but it is undeniable source code availability and other FOSS customs tipped the scale in the community’s favor. [1] https://jdsalaro.com/note/xz-liblzma-linux-backdoor-foss-pitfalls-strengths https://jdsalaro.com/note/xz-liblzma-linux-backdoor-foss-pit...

TZubiri 3y ago
But open sourceness in no way contributed to this being found, it was not in the source code. If something like this happened in windows, it could be found in the same way, and the culprit could be identified and charged with crimes. Just take the L for FOSS instead of trying a UNO reverse card
- jdsalaro 3y ago
  [flagged]
- wolverine876 3y ago
  > But open sourceness in no way contributed to this being found, it was not in the source code. Where was it? The explanation I saw included obsfucated code. ?

wolverine876 3y ago

I've now seen four articles in a range of publications using the xz incident to say that same thing about FOSS. Here's one in a defense industry publication: https://www.defenseone.com/ideas/2024/04/how-fix-militarys-software-snafu/395489/ https://www.defenseone.com/ideas/2024/04/how-fix-militarys-s... When it appears in diverse multiple places simultaneously, I generally believe someone is coordinating a media campaign. You may think that's paranoid but look at the merits of the argument: how else is it explained? They didn't coincidentally think of the exact same argument, especially when FOSS's reputation has been well-established for a long time - why now, for this particiular vulnerability, are all these people suddenly expressing doubts? And they didn't read each other's articles: these articles need to be thought of, written, edited, and published. You (those reading on HN) needs to push back and point out the absurdity of the argument now. Otherwise, even if it doesn't cause major changes, it will plant a seed - FUD, using the old IBM technique. Next time there's a incident, they will just keep beating that drum, as for-profit companies make another reach for more power. I'm sure others here will point out plenty of flaws in the argument; biggest of all is that proprietary software has the same problems - you can list them with ease. Who is behind it? We may know when the first one says they are discontinuing using FOSS. EDIT: Another reason to think it's coordinated: It's absolute BS. Nobody in IT would seriously make this claim. Everyone uses FOSS one way or another, and everyone has seen plenty of awful proprietary software. It's a deception intended for the uninformed outside IT. Think about it: Many people saying the truth simultaneously makes sense. But for many people to come up with the same BS - and any IT professional is deceiving people knowingly - that takes coordination.

kibwen 3y ago
> I generally believe someone is coordinating a media campaign. You don't need centralized coordination. Companies that sell closed-source software are inherently incentivized to defend their practices and denigrate their competitors. It's not a cabal, it's the systematic perverse incentives created by financial interests.
- wolverine876 3y ago
  Why haven't I seen that argument previously when there were vulnerabilities? Why are all these people suddenly saying it, all at the same time?

BlueTemplar 3y ago

> But just because something is your hobby doesn't mean you're not a professional at it. While I do understand how you use that word here, it literally does, and it does in the general case because of incentives. (Thankfully, exceptional people that rise above this do exist, but hopefully we'll find a way to do better than basically using martyrs.)

intelVISA 3y ago

at least with Windows the backdoors are obscured from my immediate view!!