4 ms·

A vulnerability like this one sells for $1 mil. At this point is cheaper to hire 5 full time programmers for a year to just introduce a vulnerability in an ope

A vulnerability like this one sells for $1 mil. At this point is cheaper to hire 5 full time programmers for a year to just introduce a vulnerability in an open-source project. Do it the old Google way - you work 80% of time on legit features and bug fixes to get credibility and in 20% of time you work on the backdoor.

austin-cheney 3y ago
Sounds like it might actually be cheaper to hire people who can actually program as opposed to the more common pretenders reliant upon NPM and React, Angular, or jQuery do 98% of the job.
- deleted 3y ago
  [deleted]
- TheNewsIsHere 3y ago
  I don’t necessarily disagree with your point, but frameworks and libraries are very useful. Their gross value could be said to be relative to whether the risks of relying on them ended up being worth it. A very well vetted library to do something tricky may be more reliable than reinventing the wheel. But to your point — a former employer of mine is the company behind a major SaaS application used everywhere from “you and I” to companies like Apple, Workday, IBM, and Disney. I once overheard an executive remark that “we need to do something” about the (figurative) “million NPM packages and JS libraries” that got pulled down when you compiled the server.
  - austin-cheney 3y ago
    The reductio ad nausium of it is always fear versus measures. People who fear (fill in the blank reason) require outside parties to solve basic problems for them. This is the reason people use frameworks, because its this big thing somebody else wrote that does things you don't want to consider. If, on the other hand, your primary consideration is to achieve some manner of a measure you won't care what tool you use, if any, because its all arbitrary. The deciding factor is not your self-interested level of comfort but a numeric quality compared to some other numeric quality. This is why I abandoned my 15 year JavaScript career. Its full of cowardly people who cannot measure anything because, even when they are so capable, measuring things may reveal uncomfortable and highly contrary conclusions.
realusername 3y ago
Especially that a normal vulnerability is exploitable by anybody who finds it. The state actor had then two choices when finding one, keeping it secret at the cost of leaving a lot of their own computers vulnerable or disclosing it but they cannot use it anymore. Backdoors on the other hand can be made reasonably locked to keep it to themselves, like the one introduced in xz. They don't have this dilemma.
- voakbasda 3y ago
  That’s a false dichotomy. Once a vulnerability is found (or manufactured), the attacker can patch their own systems while continuing to exploit other vulnerable systems.
  - dist-epoch 3y ago
    Their own systems might be an entire country. You can't hide patching on that scale.
  - realusername 3y ago
    How many government departments you can realistically reach before it leaks out somewhere though?

austin-cheney 3y ago

Sounds like it might actually be cheaper to hire people who can actually program as opposed to the more common pretenders reliant upon NPM and React, Angular, or jQuery do 98% of the job.

deleted 3y ago
[deleted]
TheNewsIsHere 3y ago
I don’t necessarily disagree with your point, but frameworks and libraries are very useful. Their gross value could be said to be relative to whether the risks of relying on them ended up being worth it. A very well vetted library to do something tricky may be more reliable than reinventing the wheel. But to your point — a former employer of mine is the company behind a major SaaS application used everywhere from “you and I” to companies like Apple, Workday, IBM, and Disney. I once overheard an executive remark that “we need to do something” about the (figurative) “million NPM packages and JS libraries” that got pulled down when you compiled the server.
- austin-cheney 3y ago
  The reductio ad nausium of it is always fear versus measures. People who fear (fill in the blank reason) require outside parties to solve basic problems for them. This is the reason people use frameworks, because its this big thing somebody else wrote that does things you don't want to consider. If, on the other hand, your primary consideration is to achieve some manner of a measure you won't care what tool you use, if any, because its all arbitrary. The deciding factor is not your self-interested level of comfort but a numeric quality compared to some other numeric quality. This is why I abandoned my 15 year JavaScript career. Its full of cowardly people who cannot measure anything because, even when they are so capable, measuring things may reveal uncomfortable and highly contrary conclusions.

realusername 3y ago

Especially that a normal vulnerability is exploitable by anybody who finds it. The state actor had then two choices when finding one, keeping it secret at the cost of leaving a lot of their own computers vulnerable or disclosing it but they cannot use it anymore. Backdoors on the other hand can be made reasonably locked to keep it to themselves, like the one introduced in xz. They don't have this dilemma.

voakbasda 3y ago
That’s a false dichotomy. Once a vulnerability is found (or manufactured), the attacker can patch their own systems while continuing to exploit other vulnerable systems.
- dist-epoch 3y ago
  Their own systems might be an entire country. You can't hide patching on that scale.
- realusername 3y ago
  How many government departments you can realistically reach before it leaks out somewhere though?