8 ms·
That's great that you are considering this more now. But the xy story taught us, that every contributor is dangerous, the most dangerous ones are probably the
by andix 2y ago
That's great that you are considering this more now.
But the xy story taught us, that every contributor is dangerous, the most dangerous ones are probably the most helpful and most skilled contributors. If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor.
Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Compromising people is the core competency of intelligence, happens all the time, and most cases probably never come to public knowledge.
- andix 2y agoOne follow up to compromising existing maintainers: This makes the creators or long-term good faith maintainers maybe even more "dangerous" than new maintainers.
- WanderPanda 2y agoAre we facing a Byzantine generals kind of situation now?
- Mtinie 2y agoWe have always faced it, it’s just that there's more awareness of the potential issues.
- tschwimmer 2y ago>If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. Unforuntately it's easy to sandbag being dumb. Just because someone submits a PR defining constants for 0-999 does not mean they're actually bad at programming.
- andix 2y agoSure, but being known for submitting bad code is going to make code reviews more thorough, not less. It's drawing additional attention to yourself.
- MenhirMike 2y ago> defining constants for 0-999 That person might just be an old school Java <5 developer.
- chipdart 2y agoThat person might just be a regular Java developer who works on a project which onboarded Checkstyle, and can't disable it's MagicNumber check. https://checkstyle.sourceforge.io/checks/coding/magicnumber.html https://checkstyle.sourceforge.io/checks/coding/magicnumber....
- raxxorraxor 2y agoMan, I hate such tools. Do I run into problems when I try to convert seconds to minutes? Larger problem than magic numbers ever could be.
- MenhirMike 2y agoYes! Anytime you see a function signature like "int timeout", it's safe to assume that the unit is in femtoseconds and pass a gigantic number while you curse out the incompetence of the developer. Either name your variables correctly (timeoutZeptoseconds), or use a proper data type (like a Duration or Period in Java, TimeSpan in C#, or a user-defined literal in C++).
- andix 2y agoOh, now I get why you need those constants: var secondsPerWeek = Math.pow(2, SEVEN) * Math.pow(THREE, THREE) * Math.pow(FIVE, 2) * SEVEN
- vundercind 2y agoHow incredibly wasteful. You can form most useful numbers with just ten singe-digit constants, some casting, and string concatenation.
- peteradio 2y agoIndeed, in python you can just eval.
- victorbjorklund 2y ago> Compromising people is the core competency of intelligence, happens all the time, and most cases probably never come to public knowledge. Yea. It would almost be strange if security service didnt consider the route of getting "kompromat" on a developer to make them "help" them.
- andix 2y agoThey would be really bad at their job, if they didn't try.
- transpute 2y agoDevelopers would be really bad at their newly expanded job, if they didn't resist.
- MichaelZuo 2y agoThe most secure systems are those that are also resistant to rubber hose cryptography.
- nbk_2000 2y ago"Rubber Hose Cryptography" comes in the form of a PR. "Rubber Hose Cryptanalysis" comes in the back door and waits for you in the dark.
- MichaelZuo 2y agoNo, it 'comes in the form of' a rubber hose...
- nyokodo 2y ago> consider the route of getting "kompromat" on a developer to make them "help" them I suppose that’s an option, but it also introduces an additional risk of exposure for your operation as it doesn’t always work and makes it much more complicated to manage even when it does work.
- arp242 2y ago[flagged]
- Der_Einzige 2y ago[flagged]
- deleted 2y ago[deleted]
- nineteen999 2y agoFlipside of that being a highest number of school shootings in the world.
- jrockway 2y agoI don't think the "armed to the teeth" theory is correct. If you were right, people wouldn't honk at each other or otherwise involve themselves in any sort of road rage. But people rage at each other all the time, and only very rarely does someone get shot. The reason people aren't walking around stabbing you in the eye with a needle is because there is no reason for them to do that. They gain nothing. They don't desire that it be done.
- emodendroket 2y agoIf the news articles about Instagram extortion are anything to go by, adding weapons to an extortion situation is more likely to lead to a suicide than the extortionist being dissuaded.
- andix 2y agoWe know about the failed attempts, we have no idea about the successful ones, and the ones that are going to be successful in the future.
- arp242 2y agoYou can always use this line because you can never prove something doesn't exist. Go find evidence. It's been over a month.
- xpe 2y agoWho can share a threat model with specific probability estimates on this? FWIW, I’m less interested in the particular estimates (priors) and more interested in the structure.
- mavelikara 2y ago> Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Also not talked about a lot - there are many ways to compromise existing software engineers who are paid to work on proprietary software systems.
- bee_rider 2y agoIt is a worthwhile reminder. But, source-not-available proprietary systems are just totally hopeless from this point of view, of course an intelligence agency could slip something on. A bored developer at the company could too. Users of this sort of proprietary system have just chosen to have 100% faith for some incomprehensible reason.
- spopejoy 2y agoI don't think that's relevant to this discussion though, as open- and closed-source subversion would seem to follow really different paths. - Open-source subversion has the big advantage of having the code, testing and build processes in the open which allows for the attack surface to be exhaustively studied, whereas closed source requires code exfil, reverse engineering, inside intel on processes etc. - Closed-source subversion can hide in other places -- binaries can be corrupted on a compromised server etc. Seeking to influence the code-based development seems like the hardest road IMO. - Open-source maintenance (at least the kind under discussion here) stops at the maintainer, whereas most corporate dev is in a hierarchy with non-uniform commit authority. None of the same social techniques would apply.
- lupusreal 2y ago> If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. That's true, but it's also true that a sophisticated and well formed PR is probably genuine too. Hostile PRs are the exception rather than the rule. And if only the high quality PRs are treated with suspicion, then the attackers will tailor their approach to mimic novices. General vigilance is required, but failure is likely because these attacks are so rare that maintainers will grow weary of being paranoid about a threat they've never seen in years of suspicion and let their guard down.
- lytefm 2y agoEarly this year, I've received a hostile PR for a "maintenance only" JavaScript authentication library with less than 100 stars but which is actively used by my employer. It added a "kinda useful but not really needed" feature and removed an unrelated line of code, thereby introducing a minor security vulnerability. My suspicion is that these low quality PRs are similar to the intentional typos in spam emails: Identify projects/ maintainers who are sloppy/ gullible enough and start getting a foot in the door.