5 ms·

I know part of the fun of oss is anyone can contribute behind an anonymous github username, but is this a wake up call for the package owners? Do we need at le

I know part of the fun of oss is anyone can contribute behind an anonymous github username, but is this a wake up call for the package owners? Do we need at least some form of basic identity verification (even in the form of an employer link, LinkedIn, or similar)?

some_furry 3y ago
No. I love contributing as my fursona sometimes. I don't want to dox myself to do so. We shouldn't need to know who you are to be verify that your contribution is trustworthy. Code should stand on its own merits. Ideas like this tend to dovetail into "real name policies", which suck https://www.eff.org/deeplinks/2014/09/facebooks-real-name-policy-can-cause-real-world-harm-lgbtq-community https://www.eff.org/deeplinks/2014/09/facebooks-real-name-po...
CiPHPerCoder 3y ago
I've argued in a blog post [1] that we need to delineate between "open source developer" and "supplier". If we don't do that, calling thankless unpaid volunteers and hobbyists a "supply chain" is kind of insulting [2]. I don't believe that "identity verification" for F/OSS developers is a good idea. Suppliers? Sure. That can be a contract negotiation when you decide how much you pay for it. Also, I don't think identity verification helps when your adversary is a nation state, which can just falsify government identification if it suits them. [1] https://scottarc.blog/2024/04/04/open-source-supply-chains-and-bears-oh-my/ https://scottarc.blog/2024/04/04/open-source-supply-chains-a... [2] https://crankysec.com/blog/supply/ https://crankysec.com/blog/supply/
- xcrunner529 3y ago
  Just because it can by beaten doesn’t mean making it harder isn’t useful. This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI.
  - mbs159 3y ago
    Not everyone dev that uses a VPN or something like Tor is doing so due to some malicious reasons. Some people face challenges regarding privacy.
  - CiPHPerCoder 3y ago
    > Just because it can by beaten doesn’t mean making it harder isn’t useful. Fair. > This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI. I disagree strongly, and am surprised to hear this argument on Hacker News of all places.
    - ogurechny 3y ago
      People are so used to see artificial bureaucratic structures as more real than their real counterparts that they constantly invent such naive solutions. “Just make the gub'ment provide an official paper (with a stamp) that Joe Random Dude is a real developer, a father of two, not a fan of satanic metal music, and the project will be safe”.
      - xcrunner529 3y ago
        People already do this in a general sense for authenticating a person and deciding if they’re trustworthy.
        ogurechny 3y ago
        Not “trustworthy”, but “able to play their role in certain scenes”. When you're outside of that structure, those decorated clothes lose any meaning.
    - jamespo 3y ago
      The VPN is just part of the picture (sock puppet accounts complaining about speed of dev, no meaningful history of other contributions from the dev, no trusted "personal network" for the dev, etc) that in hindsight should have raised red flags.
usefulcat 3y ago
> Do we need at least some form of basic identity verification For dedicated attackers (as was the case here) that will move the goal posts ever so slightly farther away, but not much else. I see how it's tempting to focus on identity, but I don't see how it's productive.
redox99 3y ago
State actors (probably the case here) can handle all that stuff.
- microtonal 3y ago
  If an identity (known or pseudonymous) was signed by a government, there would at least be some accountability. Like if Jia Tan's identity is signed by government X, then there is a good hint that they are a state actor for X or otherwise there is a burden for X to come up with convincing evidence that this is not the case. Obviously, every system is going to have weaknesses, but it would at least introduce some accountability. The main issues are all related to privacy. What if your government is not nice and you don't want them to track all your contributions?
  - wasmitnetzen 3y ago
    Let's say we would have definite proof that this was a Chinese op. Then what? No other government is gonna complain too hard because they know that their own agencies are doing the very same thing too. Additionally, creating fake identities in other states is base level spying.
    - microtonal 3y ago
      No other government is gonna complain Maybe not. But to the open source community it does provide more information. Now it's completely unclear who compromised xz, if the account had a government-level signature of some sort, more is known. Also, the open source community could have different levels of trust in authors with different signing authorities [1]. Additionally, creating fake identities in other states is base level spying. We are not talking about a fake identity here (as in a fake passport or whatever), but getting a signature from a device that is presumably in a facility that is disconnected from the network. The user's identities would also live on a hardware device (e.g. chip embedded in a passport/id). You could steal the hardware device to steal someone's developer identity. But the identity can be revoked once the device is reported/stolen. So, it is hard to play the long game with a stolen identity, outside blackmailing or otherwise compelling a developer to make their identity available (but even in that case it'd give some leads in understanding who the actor is). Apple Developer signing keys are similar. You can verify where an app comes from. If a developer goes rogue or their key is compromised, Apple can revoke it. Apple could do evil stuff by creating sock puppet accounts, but that would devalue the trust in their signing key. --- [1] I should note that I am not in favor of this. It's a privacy nightmare and it would give governments a lot of control over developers. I just think the argument upthread that a state actor could fake anything is not true. If e.g. the US had such an identity signing system, a foreign power could not forge the identities as long as the US private key is not compromised.
jaza 3y ago
https://www.linkedin.com/pub/dir/Jia/Tan https://www.linkedin.com/pub/dir/Jia/Tan Take your pick! 1600+ to choose from.
logro 3y ago
For a state level attack, that wouldn't even help. They'd just use state level forged documents.
cesarb 3y ago
> Do we need at least some form of basic identity verification (even in the form of an employer link, LinkedIn, or similar)? Not all free software contributors are employed. They might be too young (it's not unusual to start contributing to free software while still in school), too old and already retired, be part of a family where another family member is the working one, do freelance or informal work, or be searching for work at the moment. And even those who are employed do not necessarily have it visible on their employer's website; for instance, I don't think my current employer has any publicly available page listing all employees, and I never had (and don't have any desire for) a LinkedIn account.
maxbond 3y ago
Identity is a red herring. Backdoors are intentional vulnerabilities and are discoverable through vulnerability analysis. You can't solve identity, and real, verified people can still betray you. Even trustworthy people can betray you, either unwillingly or unwittingly. You can't solve vulnerability analysis either (it's the halting problem), but you also can't shirk it. You might as well go all in on it rather than undermining the basis of open source collaboration and many eyes making bugs shallow. But it certainly is a wake up call of some kind.
ahoka 3y ago
some projects are asking for physical id and signing a contract since decades

some_furry 3y ago

No. I love contributing as my fursona sometimes. I don't want to dox myself to do so. We shouldn't need to know who you are to be verify that your contribution is trustworthy. Code should stand on its own merits. Ideas like this tend to dovetail into "real name policies", which suck https://www.eff.org/deeplinks/2014/09/facebooks-real-name-policy-can-cause-real-world-harm-lgbtq-community https://www.eff.org/deeplinks/2014/09/facebooks-real-name-po...

CiPHPerCoder 3y ago

I've argued in a blog post [1] that we need to delineate between "open source developer" and "supplier". If we don't do that, calling thankless unpaid volunteers and hobbyists a "supply chain" is kind of insulting [2]. I don't believe that "identity verification" for F/OSS developers is a good idea. Suppliers? Sure. That can be a contract negotiation when you decide how much you pay for it. Also, I don't think identity verification helps when your adversary is a nation state, which can just falsify government identification if it suits them. [1] https://scottarc.blog/2024/04/04/open-source-supply-chains-and-bears-oh-my/ https://scottarc.blog/2024/04/04/open-source-supply-chains-a... [2] https://crankysec.com/blog/supply/ https://crankysec.com/blog/supply/

xcrunner529 3y ago
Just because it can by beaten doesn’t mean making it harder isn’t useful. This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI.
- mbs159 3y ago
  Not everyone dev that uses a VPN or something like Tor is doing so due to some malicious reasons. Some people face challenges regarding privacy.
- CiPHPerCoder 3y ago
  > Just because it can by beaten doesn’t mean making it harder isn’t useful. Fair. > This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI. I disagree strongly, and am surprised to hear this argument on Hacker News of all places.
  - ogurechny 3y ago
    People are so used to see artificial bureaucratic structures as more real than their real counterparts that they constantly invent such naive solutions. “Just make the gub'ment provide an official paper (with a stamp) that Joe Random Dude is a real developer, a father of two, not a fan of satanic metal music, and the project will be safe”.
    - xcrunner529 3y ago
      People already do this in a general sense for authenticating a person and deciding if they’re trustworthy.
      - ogurechny 3y ago
        Not “trustworthy”, but “able to play their role in certain scenes”. When you're outside of that structure, those decorated clothes lose any meaning.
  - jamespo 3y ago
    The VPN is just part of the picture (sock puppet accounts complaining about speed of dev, no meaningful history of other contributions from the dev, no trusted "personal network" for the dev, etc) that in hindsight should have raised red flags.

usefulcat 3y ago

> Do we need at least some form of basic identity verification For dedicated attackers (as was the case here) that will move the goal posts ever so slightly farther away, but not much else. I see how it's tempting to focus on identity, but I don't see how it's productive.

redox99 3y ago

State actors (probably the case here) can handle all that stuff.

microtonal 3y ago
If an identity (known or pseudonymous) was signed by a government, there would at least be some accountability. Like if Jia Tan's identity is signed by government X, then there is a good hint that they are a state actor for X or otherwise there is a burden for X to come up with convincing evidence that this is not the case. Obviously, every system is going to have weaknesses, but it would at least introduce some accountability. The main issues are all related to privacy. What if your government is not nice and you don't want them to track all your contributions?
- wasmitnetzen 3y ago
  Let's say we would have definite proof that this was a Chinese op. Then what? No other government is gonna complain too hard because they know that their own agencies are doing the very same thing too. Additionally, creating fake identities in other states is base level spying.
  - microtonal 3y ago
    No other government is gonna complain Maybe not. But to the open source community it does provide more information. Now it's completely unclear who compromised xz, if the account had a government-level signature of some sort, more is known. Also, the open source community could have different levels of trust in authors with different signing authorities [1]. Additionally, creating fake identities in other states is base level spying. We are not talking about a fake identity here (as in a fake passport or whatever), but getting a signature from a device that is presumably in a facility that is disconnected from the network. The user's identities would also live on a hardware device (e.g. chip embedded in a passport/id). You could steal the hardware device to steal someone's developer identity. But the identity can be revoked once the device is reported/stolen. So, it is hard to play the long game with a stolen identity, outside blackmailing or otherwise compelling a developer to make their identity available (but even in that case it'd give some leads in understanding who the actor is). Apple Developer signing keys are similar. You can verify where an app comes from. If a developer goes rogue or their key is compromised, Apple can revoke it. Apple could do evil stuff by creating sock puppet accounts, but that would devalue the trust in their signing key. --- [1] I should note that I am not in favor of this. It's a privacy nightmare and it would give governments a lot of control over developers. I just think the argument upthread that a state actor could fake anything is not true. If e.g. the US had such an identity signing system, a foreign power could not forge the identities as long as the US private key is not compromised.

jaza 3y ago

https://www.linkedin.com/pub/dir/Jia/Tan https://www.linkedin.com/pub/dir/Jia/Tan Take your pick! 1600+ to choose from.

logro 3y ago

For a state level attack, that wouldn't even help. They'd just use state level forged documents.

cesarb 3y ago

> Do we need at least some form of basic identity verification (even in the form of an employer link, LinkedIn, or similar)? Not all free software contributors are employed. They might be too young (it's not unusual to start contributing to free software while still in school), too old and already retired, be part of a family where another family member is the working one, do freelance or informal work, or be searching for work at the moment. And even those who are employed do not necessarily have it visible on their employer's website; for instance, I don't think my current employer has any publicly available page listing all employees, and I never had (and don't have any desire for) a LinkedIn account.

maxbond 3y ago

Identity is a red herring. Backdoors are intentional vulnerabilities and are discoverable through vulnerability analysis. You can't solve identity, and real, verified people can still betray you. Even trustworthy people can betray you, either unwillingly or unwittingly. You can't solve vulnerability analysis either (it's the halting problem), but you also can't shirk it. You might as well go all in on it rather than undermining the basis of open source collaboration and many eyes making bugs shallow. But it certainly is a wake up call of some kind.

ahoka 3y ago

some projects are asking for physical id and signing a contract since decades