4 ms·

All of this is nice but none of it stops the style of hack that happened to xz besides the fact that it's very unlikely Dan is going to be bullied into handing

All of this is nice but none of it stops the style of hack that happened to xz besides the fact that it's very unlikely Dan is going to be bullied into handing over maintainership to someone else. Every other element on the list can be attacked if the maintainer themselves is the malicious party carrying out the attack and it is being performed with the level of sophistication in the xz attack. So ya, I'm not saying it's security theater in all contexts, but if the context is the attack vector used in the xz attack, it's security theater.

lrvick 3y ago
> unlikely Dan is going to be bullied into handing over maintainership to someone else. Most everyone has a love for money, their own health, or people they wish to protect. This weakness will be exploited by those that understand a tampered version of curl in the right cryptocurrency company CI job can net billions of dollars. We absolutely must never trust any single person in a widely relied upon software supply chain for their own safety and ours. Any trust in any single human or machine is a very real security vulnerability. Even without jumping to coercion, people let personal email domain names expire, they get phished, their workstation is compromised by a new steam game or IDE plugin with an RCE, etc. I have performed and been read in on a number of attacks like this in the wild as part of pentests. It is often brutally easy.
nebulous1 3y ago
We have to move away from prerun autotools scripts in tarballs entirely, but honestly I don't expect curl to be at the forefront of that. It's not clear (to me) that Lasse knew that Jia Tan was pseudonymous. I agree with him that it's going to be harder to target curl though, as it's a larger project (maintainer-wise) and he's personally releasing all of the tarballs.
kuschkufan 3y ago
Actually the fact that they do not have binary blobs in their repo immediately stops the xz attack. Not saying attackers would fail with curl in general. Just repeating the exact method from xz is not possible.

lrvick 3y ago

> unlikely Dan is going to be bullied into handing over maintainership to someone else. Most everyone has a love for money, their own health, or people they wish to protect. This weakness will be exploited by those that understand a tampered version of curl in the right cryptocurrency company CI job can net billions of dollars. We absolutely must never trust any single person in a widely relied upon software supply chain for their own safety and ours. Any trust in any single human or machine is a very real security vulnerability. Even without jumping to coercion, people let personal email domain names expire, they get phished, their workstation is compromised by a new steam game or IDE plugin with an RCE, etc. I have performed and been read in on a number of attacks like this in the wild as part of pentests. It is often brutally easy.

nebulous1 3y ago

We have to move away from prerun autotools scripts in tarballs entirely, but honestly I don't expect curl to be at the forefront of that. It's not clear (to me) that Lasse knew that Jia Tan was pseudonymous. I agree with him that it's going to be harder to target curl though, as it's a larger project (maintainer-wise) and he's personally releasing all of the tarballs.

kuschkufan 3y ago

Actually the fact that they do not have binary blobs in their repo immediately stops the xz attack. Not saying attackers would fail with curl in general. Just repeating the exact method from xz is not possible.