3 ms·

"Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. The fact that this po

"Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. The fact that this possibility has been routinely dismissed for decades doesn't make it any less of a real security threat. This is kinda like assuming that blockchain can prevent crypto fraud. And the full irony of this potentially catastrophic backdoor being discovered by a *Microsoft* employee still seems to be largely lost on the Open Source community. Security requires a lot more than just source code --- like maybe vetting those involved in the process. People are almost always the weakest link in any security system.

xinayder 3y ago
Where's the irony in it being discovered by a MS employee? As far as I know he was working on a personal project and decided to debug why SSH logins were taking longer than expected, and found the backdoor. > "Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. I don't get this stance. Saying the true nature of open source is also its weakness is an ad hominem IMO, usually spat out from people that dislike the open source ideology. What's the solution? Developing stuff at walled gardens and praying to god that the maintainers will be beneficent enough to report a security breach? We've seen how that works out, companies take a year or so to report a breach after the damage was done. > The fact that this possibility has been routinely dismissed for years doesn't make it any less of a real security threat. This is kinda like assuming that blockchain can prevent crypto fraud. It wasn't dismissed, it was just simply proven by experience that this is just FUD to undermine open source. And even if it is true, the good things coming out of OS ideology are much greater than the possible bad things. Let me give you an example of why this is FUD. ClamAV is an open source malware analysis tool and yet, it's being constantly updated with new malware signatures. The fact of it being open source did nothing to sever its ability of detecting malware.
- robertlagrant 3y ago
  > Saying the true nature of open source is also its weakness is an ad hominem IMO Ad hominem is criticising the person making the argument, rather than the argument itself. This seems to be not that. > usually spat out from people that dislike the open source ideology. This is a good example of ad hominem.
- jqpabc123 3y ago
  Where's the irony in it being discovered by a MS employee? If not for his day job producing non-Open Source software, he would likely have lacked the time and skill to devote to this Open Source project. Moral to the story --- developers can not live by Open Source alone.
robertlagrant 3y ago
> And the full irony of this potentially catastrophic backdoor being discovered by a Microsoft employee still seems to be largely lost on the Open Source community. I'm not sure things can be lost on a community. Aren't Microsoft part of that community?
- graemep 3y ago
  > Aren't Microsoft part of that community? The MS employee who discovered the issue is definitely part of the open source community. A significant contributor to a major project AFAIK.
  - jqpabc123 3y ago
    If all software was Open Source, there would probably be significantly fewer develeoprs doing Open Source --- and fewer developers overall. His day job is proof that he does not subscribe to the mantra that Open Source is the best or the only way to do software.
graemep 3y ago
> "Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. The bug was found before it hit production, so to that extent things worked. If there was a similar attack on proprietary software (from a malicious or suborned employee, a contractor, a sub contractor, or from the vast amounts of open source code used in most of it, or by some other route) we might never have known. It certainly could not have been investigated by someone who did not have access to the source.
- ranger_danger 3y ago
  > The bug was found before it hit production But it was found by pure accident in someone's spare time and not as part of any standard testing/procedures.
  - chasil 3y ago
    How can we be sure that it was found by accident?
    - ranger_danger 3y ago
      We can't, you're right I just took them for their word on it. Just like we can't know that this was actually intentional or done by a professional or state actor.
  - graemep 3y ago
    I thought he was working, not doing it in his spare time? He is paid to work on Postgres and that is what he was doing when he spotted it, right?
- jqpabc123 3y ago
  The bug was found before it hit production, so to that extent things worked. Not according to the article: "Ubuntu 24.04 LTS (Noble Numbat) also contained the infected files, which have since been removed. Advisories were also issued by Arch and openSUSE." Bottom line: This is proof that there is very little vetting of either code or the people involved in these projects. In many cases, the people are unknown/anonymous. This is a gaping security hole that someone just spent a lot of time and effort to exploit.
rho138 3y ago
Something something solarwinds something something

xinayder 3y ago

Where's the irony in it being discovered by a MS employee? As far as I know he was working on a personal project and decided to debug why SSH logins were taking longer than expected, and found the backdoor. > "Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. I don't get this stance. Saying the true nature of open source is also its weakness is an ad hominem IMO, usually spat out from people that dislike the open source ideology. What's the solution? Developing stuff at walled gardens and praying to god that the maintainers will be beneficent enough to report a security breach? We've seen how that works out, companies take a year or so to report a breach after the damage was done. > The fact that this possibility has been routinely dismissed for years doesn't make it any less of a real security threat. This is kinda like assuming that blockchain can prevent crypto fraud. It wasn't dismissed, it was just simply proven by experience that this is just FUD to undermine open source. And even if it is true, the good things coming out of OS ideology are much greater than the possible bad things. Let me give you an example of why this is FUD. ClamAV is an open source malware analysis tool and yet, it's being constantly updated with new malware signatures. The fact of it being open source did nothing to sever its ability of detecting malware.

robertlagrant 3y ago
> Saying the true nature of open source is also its weakness is an ad hominem IMO Ad hominem is criticising the person making the argument, rather than the argument itself. This seems to be not that. > usually spat out from people that dislike the open source ideology. This is a good example of ad hominem.
jqpabc123 3y ago
Where's the irony in it being discovered by a MS employee? If not for his day job producing non-Open Source software, he would likely have lacked the time and skill to devote to this Open Source project. Moral to the story --- developers can not live by Open Source alone.

robertlagrant 3y ago

> And the full irony of this potentially catastrophic backdoor being discovered by a Microsoft employee still seems to be largely lost on the Open Source community. I'm not sure things can be lost on a community. Aren't Microsoft part of that community?

graemep 3y ago
> Aren't Microsoft part of that community? The MS employee who discovered the issue is definitely part of the open source community. A significant contributor to a major project AFAIK.
- jqpabc123 3y ago
  If all software was Open Source, there would probably be significantly fewer develeoprs doing Open Source --- and fewer developers overall. His day job is proof that he does not subscribe to the mantra that Open Source is the best or the only way to do software.

graemep 3y ago

> "Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. The bug was found before it hit production, so to that extent things worked. If there was a similar attack on proprietary software (from a malicious or suborned employee, a contractor, a sub contractor, or from the vast amounts of open source code used in most of it, or by some other route) we might never have known. It certainly could not have been investigated by someone who did not have access to the source.

ranger_danger 3y ago
> The bug was found before it hit production But it was found by pure accident in someone's spare time and not as part of any standard testing/procedures.
- chasil 3y ago
  How can we be sure that it was found by accident?
  - ranger_danger 3y ago
    We can't, you're right I just took them for their word on it. Just like we can't know that this was actually intentional or done by a professional or state actor.
- graemep 3y ago
  I thought he was working, not doing it in his spare time? He is paid to work on Postgres and that is what he was doing when he spotted it, right?
jqpabc123 3y ago
The bug was found before it hit production, so to that extent things worked. Not according to the article: "Ubuntu 24.04 LTS (Noble Numbat) also contained the infected files, which have since been removed. Advisories were also issued by Arch and openSUSE." Bottom line: This is proof that there is very little vetting of either code or the people involved in these projects. In many cases, the people are unknown/anonymous. This is a gaping security hole that someone just spent a lot of time and effort to exploit.

rho138 3y ago

Something something solarwinds something something