7 ms·

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D

transpute 2y ago
US gov has encouraged finance/tech industry to invest in the security of OSS supply chains. OpenSSF members: https://openssf.org/about/members https://openssf.org/about/members 2021, $10MM, https://openssf.org/press-release/2021/10/13/open-source-security-foundation-raises-10-million-in-new-commitments-to-secure-software-supply-chains/ https://openssf.org/press-release/2021/10/13/open-source-sec... > Financial commitments from Premier members include Amazon, Cisco, Dell Technologies, Ericsson, Facebook, Fidelity, GitHub, Google, IBM, Intel, JPMorgan Chase, Microsoft, Morgan Stanley, Oracle, Red Hat, Snyk, and VMware. Additional commitments come from General members Aiven, Anchore, Apiiro, AuriStor, Codethink, Cybertrust Japan, Deepfence, Devgistics, DTCC, GitLab, Goldman Sachs, JFrog, Nutanix, StackHawk, Tencent, TideLift, and Wind River. 2022, $5MM for 10,000 OSS projects, https://openssf.org/press-release/2022/02/01/openssf-announces-the-alpha-omega-project-to-improve-software-supply-chain-security-for-10000-oss-projects/ https://openssf.org/press-release/2022/02/01/openssf-announc... > Following a meeting with government and industry leaders at the White House, OpenSSF is excited to announce the Alpha-Omega Project to improve the security posture of open source software (OSS) through direct engagement of software security experts and automated security testing. Microsoft and Google are supporting the Alpha-Omega Project with an initial investment of $5 million.. “Omega” will identify at least 10,000 widely deployed OSS projects where it can apply automated security analysis, scoring, and remediation guidance to their open source maintainer communities. 2022+2023, $4.8MM disbursed to ten (not 10K?) OSS projects, https://openssf.org/blog/2024/02/16/alpha-omega-2023-annual-report/ https://openssf.org/blog/2024/02/16/alpha-omega-2023-annual-... & https://openssf.org/blog/2022/12/14/alpha-omega-project-first-year-in-review-plus-new-funding-pledge/ https://openssf.org/blog/2022/12/14/alpha-omega-project-firs... Eclipse $1,150,000 NodeJS $579,000 Rust $920,000 Homebrew $175,000 jQuery $350,000 OpenSSL $127,968 OpenRefactory $50,000 Prossimo (ISRG) $530,000 Python $400,000 Linux Kernel $620,000
- winrid 2y ago
  Neat that jQuery gets so much. I guess they have a ton of stuff on jQuery still (and probably will forever).
- throwaway2037 2y ago
  Why did Eclipse org get so much and Apache org none/less? In my experience, the footprint of Apache exceeds anything else in enterprise programming.
  - VoidWhisperer 2y ago
    This also struck me as a bit odd.. even more so when you consider that over recent years, eclipse's general usage over time has decreased
    - transpute 2y ago
      Are OpenSFF members using Eclipse sub-projects in the financial services industry? In automotive/embedded, Eclipse hosts the safety-certified OSS ThreadX RTOS (formerly Azure RTOS), which runs on 10B+ devices, https://finance.yahoo.com/news/eclipse-foundation-showcases-successful-open-100000000.html https://finance.yahoo.com/news/eclipse-foundation-showcases-...
      - weberer 2y ago
        Ahhh, I was thinking they were just funding the IDE.
        transpute 2y ago
        It would be helpful for projects funded by OpenSSF Omega to publish details on how they prioritized use of the funds to improve supply chain security within each project.
  - gkbrk 2y ago
    Tons of modern and really critical development happens on Eclipse-based environments. Two examples I can think of off the top of my head are - DBeaver (very widely used to connect to production databases) - STM32Cube IDE (for embedded development in all sorts of devices)
pants2 2y ago
The ideal state is having the world's superpowers all devoting effort to improving open source libraries, but all catching each others' backdoors and at the end of the day improving security for everyone.
- bee_rider 2y ago
  Web of trust, but all commits must be signed by at least 3 intelligence agencies from rival countries.
  - jonhohle 2y ago
    “Web of distrust”
    - Angostura 2y ago
      Mutually Assured Commitment
      - _kb 2y ago
        Alternatively: mutually assured development.
  - transpute 2y ago
    At least 2 rival legal Jurisdictions/Alliances/Spheres At least 2 rival state intelligence Agencies per Sphere At least 2 rival corporations per Sphere TOTAL: 2*(2+2) = 8 Widely used OSS projects are contested spheres of collaboration.
    - voiper1 2y ago
      So the long game is rival countries are secretly collaborating, so we secretly have world peace!
      - glodalitazic 2y ago
chipdart 2y ago
[flagged]
- yesseri 2y ago
  I think he was making a tounge in cheek point about how we could finally get extremely well-founded open source projects.
  - chipdart 2y ago
    I did not referred to the funding remark. It is besides the point and immaterial to the discussion. My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and have a significant adoption rate but are not actively maintained. We are talking about Colors-like and Faker-like projects. All you need to pull this off is posting one message asking nicely for permissions, post a commit, and make a release. https://fossa.com/blog/npm-packages-colors-faker-corrupted/ https://fossa.com/blog/npm-packages-colors-faker-corrupted/
    - soks86 2y ago
      The comment was not sincere and is meant to amuse. If you believe amusement is a disservice to the community then I believe many others disagree. edit: For clarity, the "since inception" part is an absurd setup for the, equally absurd, "well funded open source" part.
      - Teknomancer 2y ago
        Taking over Open Source, just for the LULz. There is an extreme lack of sense of humor around these parts. I lol'd, and thank you for that.
    - solumunus 2y ago
      Double whoosh then I guess.
Ygg2 2y ago
> So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library This already happened. *cough* React *cough* Ask yourself, why would rogue AI and famous human impersonator Mark (short for Mark Zero Ai) Zuckerberg make an open-source UI library for everyone to use? /tinfoil That said, who knows, maybe it already happened.
loa_in_ 2y ago
If it's an everybody uses it solution it will eventually be reimplemented as a part of the environment, like the browser or the kernel. The lifetime is limited and linking to a library like that wouldn't mesh very well there.
- wongarsu 2y ago
  You can easily get two decades out of solutions like libjpeg, the GNU project, systemd, busybox, rsync, etc.
varispeed 2y ago
Relevant: https://www.youtube.com/watch?v=jgYYOUC10aM https://www.youtube.com/watch?v=jgYYOUC10aM
Nition 2y ago
A kind of similar thing happened with game key scammers. People will email the devs of hundreds of Steam games pretending to be a popular YouTuber, asking for keys for themselves and usually a few extra "for a giveaway". If they get the keys, they'll try to resell them for a profit. At first you'd get emails from like, pewdiepie@outlook.com instead of pewdiepie@gmail.com. But you could usually check the YouTube about page to find the real business email and compare it. So eventually the scammers started creating their own YouTube channels. They'd steal videos from other channels and reupload them, then get bots to add views and subscribers. Now the email matches the one on their channel. One remaining tell tended to be the lack of comments, but it's been a few years since I had a game that was getting those kind of emails, and I wouldn't be surprised if they have good fake video comments these days too. Here are a couple of examples of fake channels I have saved from a few years ago: https://www.youtube.com/channel/UCzOhUFVqJSGk20eB0kFCyOg https://www.youtube.com/channel/UCzOhUFVqJSGk20eB0kFCyOg https://www.youtube.com/channel/UC_TgLJm0paPjmJQTWaHqDhQ https://www.youtube.com/channel/UC_TgLJm0paPjmJQTWaHqDhQ
- saagarjha 2y ago
  Relevant xkcd: https://xkcd.com/810/ https://xkcd.com/810/
- flumpcakes 2y ago
  How do you know those two channels are "fake" or "scammers"? I think I have a good eye for these things and worryingly they just look like the normal low effort youtube chaff but I wouldn't have thought fake/scamming.
  - Nition 2y ago
    Some common indicators (though this may have changed - I can only speak for ~7 years ago): - Weird view counts. Strangely consistent, random sudden dropoff to near zero views, etc. - No voice commentary. Can't steal videos from different channels if your "voice" changes I guess. - A whole set of videos uploaded at once. This was more obvious when the linked channels were still active since you'd see like two rows of "2 days ago", then a bunch "1 week ago", then a bunch "3 weeks ago" etc. - Social media etc links either missing or super basic. - Few and generic comments vs. amount of views. - Channel description generic, sometimes copied from other channels. - The two I linked haven't done it, but some I saw were uploading long-plays of games split into many parts, I guess to easily pad out their total number of videos. Another thing they were doing at the time, was changing their channel name and banner after a few weeks or months and then emailing again pretending to be a whole new channel. Easy to spot if you still had the old link and it was the same. The second one I linked also mysteriously turns Russian if you scroll back far enough. Bit unusual for someone with their location listed as USA.
smnplk 2y ago
The solution is blockchain! /s
belter 2y ago
> Great that we'll finally get state-sponsored open-source development :D Suspicions are very old: "Report of FBI back door roils OpenBSD community" (2010)- https://www.cnet.com/news/privacy/report-of-fbi-back-door-roils-openbsd-community/ https://www.cnet.com/news/privacy/report-of-fbi-back-door-ro...
- wongarsu 2y ago
  Also TOR being overtly created and sponsored by the US government, leading to some distrust
d0mine 2y ago
Or even better: push a cryptographic protocol with a builtin weakness as a standard and deprecate others as "insecure." Any implementation would be vulnerable.
deleted 2y ago
[deleted]

transpute 2y ago

US gov has encouraged finance/tech industry to invest in the security of OSS supply chains. OpenSSF members: https://openssf.org/about/members https://openssf.org/about/members 2021, $10MM, https://openssf.org/press-release/2021/10/13/open-source-security-foundation-raises-10-million-in-new-commitments-to-secure-software-supply-chains/ https://openssf.org/press-release/2021/10/13/open-source-sec... > Financial commitments from Premier members include Amazon, Cisco, Dell Technologies, Ericsson, Facebook, Fidelity, GitHub, Google, IBM, Intel, JPMorgan Chase, Microsoft, Morgan Stanley, Oracle, Red Hat, Snyk, and VMware. Additional commitments come from General members Aiven, Anchore, Apiiro, AuriStor, Codethink, Cybertrust Japan, Deepfence, Devgistics, DTCC, GitLab, Goldman Sachs, JFrog, Nutanix, StackHawk, Tencent, TideLift, and Wind River. 2022, $5MM for 10,000 OSS projects, https://openssf.org/press-release/2022/02/01/openssf-announces-the-alpha-omega-project-to-improve-software-supply-chain-security-for-10000-oss-projects/ https://openssf.org/press-release/2022/02/01/openssf-announc... > Following a meeting with government and industry leaders at the White House, OpenSSF is excited to announce the Alpha-Omega Project to improve the security posture of open source software (OSS) through direct engagement of software security experts and automated security testing. Microsoft and Google are supporting the Alpha-Omega Project with an initial investment of $5 million.. “Omega” will identify at least 10,000 widely deployed OSS projects where it can apply automated security analysis, scoring, and remediation guidance to their open source maintainer communities. 2022+2023, $4.8MM disbursed to ten (not 10K?) OSS projects, https://openssf.org/blog/2024/02/16/alpha-omega-2023-annual-report/ https://openssf.org/blog/2024/02/16/alpha-omega-2023-annual-... & https://openssf.org/blog/2022/12/14/alpha-omega-project-first-year-in-review-plus-new-funding-pledge/ https://openssf.org/blog/2022/12/14/alpha-omega-project-firs... Eclipse $1,150,000 NodeJS $579,000 Rust $920,000 Homebrew $175,000 jQuery $350,000 OpenSSL $127,968 OpenRefactory $50,000 Prossimo (ISRG) $530,000 Python $400,000 Linux Kernel $620,000

winrid 2y ago
Neat that jQuery gets so much. I guess they have a ton of stuff on jQuery still (and probably will forever).
throwaway2037 2y ago
Why did Eclipse org get so much and Apache org none/less? In my experience, the footprint of Apache exceeds anything else in enterprise programming.
- VoidWhisperer 2y ago
  This also struck me as a bit odd.. even more so when you consider that over recent years, eclipse's general usage over time has decreased
  - transpute 2y ago
    Are OpenSFF members using Eclipse sub-projects in the financial services industry? In automotive/embedded, Eclipse hosts the safety-certified OSS ThreadX RTOS (formerly Azure RTOS), which runs on 10B+ devices, https://finance.yahoo.com/news/eclipse-foundation-showcases-successful-open-100000000.html https://finance.yahoo.com/news/eclipse-foundation-showcases-...
    - weberer 2y ago
      Ahhh, I was thinking they were just funding the IDE.
      - transpute 2y ago
        It would be helpful for projects funded by OpenSSF Omega to publish details on how they prioritized use of the funds to improve supply chain security within each project.
- gkbrk 2y ago
  Tons of modern and really critical development happens on Eclipse-based environments. Two examples I can think of off the top of my head are - DBeaver (very widely used to connect to production databases) - STM32Cube IDE (for embedded development in all sorts of devices)

pants2 2y ago

The ideal state is having the world's superpowers all devoting effort to improving open source libraries, but all catching each others' backdoors and at the end of the day improving security for everyone.

bee_rider 2y ago
Web of trust, but all commits must be signed by at least 3 intelligence agencies from rival countries.
- jonhohle 2y ago
  “Web of distrust”
  - Angostura 2y ago
    Mutually Assured Commitment
    - _kb 2y ago
      Alternatively: mutually assured development.
- transpute 2y ago
  At least 2 rival legal Jurisdictions/Alliances/Spheres At least 2 rival state intelligence Agencies per Sphere At least 2 rival corporations per Sphere TOTAL: 2*(2+2) = 8 Widely used OSS projects are contested spheres of collaboration.
  - voiper1 2y ago
    So the long game is rival countries are secretly collaborating, so we secretly have world peace!
    - glodalitazic 2y ago

chipdart 2y ago

[flagged]

yesseri 2y ago
I think he was making a tounge in cheek point about how we could finally get extremely well-founded open source projects.
- chipdart 2y ago
  I did not referred to the funding remark. It is besides the point and immaterial to the discussion. My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and have a significant adoption rate but are not actively maintained. We are talking about Colors-like and Faker-like projects. All you need to pull this off is posting one message asking nicely for permissions, post a commit, and make a release. https://fossa.com/blog/npm-packages-colors-faker-corrupted/ https://fossa.com/blog/npm-packages-colors-faker-corrupted/
  - soks86 2y ago
    The comment was not sincere and is meant to amuse. If you believe amusement is a disservice to the community then I believe many others disagree. edit: For clarity, the "since inception" part is an absurd setup for the, equally absurd, "well funded open source" part.
    - Teknomancer 2y ago
      Taking over Open Source, just for the LULz. There is an extreme lack of sense of humor around these parts. I lol'd, and thank you for that.
  - solumunus 2y ago
    Double whoosh then I guess.

Ygg2 2y ago

> So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library This already happened. *cough* React *cough* Ask yourself, why would rogue AI and famous human impersonator Mark (short for Mark Zero Ai) Zuckerberg make an open-source UI library for everyone to use? /tinfoil That said, who knows, maybe it already happened.

loa_in_ 2y ago

If it's an everybody uses it solution it will eventually be reimplemented as a part of the environment, like the browser or the kernel. The lifetime is limited and linking to a library like that wouldn't mesh very well there.

wongarsu 2y ago
You can easily get two decades out of solutions like libjpeg, the GNU project, systemd, busybox, rsync, etc.

varispeed 2y ago

Relevant: https://www.youtube.com/watch?v=jgYYOUC10aM https://www.youtube.com/watch?v=jgYYOUC10aM

Nition 2y ago

A kind of similar thing happened with game key scammers. People will email the devs of hundreds of Steam games pretending to be a popular YouTuber, asking for keys for themselves and usually a few extra "for a giveaway". If they get the keys, they'll try to resell them for a profit. At first you'd get emails from like, pewdiepie@outlook.com instead of pewdiepie@gmail.com. But you could usually check the YouTube about page to find the real business email and compare it. So eventually the scammers started creating their own YouTube channels. They'd steal videos from other channels and reupload them, then get bots to add views and subscribers. Now the email matches the one on their channel. One remaining tell tended to be the lack of comments, but it's been a few years since I had a game that was getting those kind of emails, and I wouldn't be surprised if they have good fake video comments these days too. Here are a couple of examples of fake channels I have saved from a few years ago: https://www.youtube.com/channel/UCzOhUFVqJSGk20eB0kFCyOg https://www.youtube.com/channel/UCzOhUFVqJSGk20eB0kFCyOg https://www.youtube.com/channel/UC_TgLJm0paPjmJQTWaHqDhQ https://www.youtube.com/channel/UC_TgLJm0paPjmJQTWaHqDhQ

saagarjha 2y ago
Relevant xkcd: https://xkcd.com/810/ https://xkcd.com/810/
flumpcakes 2y ago
How do you know those two channels are "fake" or "scammers"? I think I have a good eye for these things and worryingly they just look like the normal low effort youtube chaff but I wouldn't have thought fake/scamming.
- Nition 2y ago
  Some common indicators (though this may have changed - I can only speak for ~7 years ago): - Weird view counts. Strangely consistent, random sudden dropoff to near zero views, etc. - No voice commentary. Can't steal videos from different channels if your "voice" changes I guess. - A whole set of videos uploaded at once. This was more obvious when the linked channels were still active since you'd see like two rows of "2 days ago", then a bunch "1 week ago", then a bunch "3 weeks ago" etc. - Social media etc links either missing or super basic. - Few and generic comments vs. amount of views. - Channel description generic, sometimes copied from other channels. - The two I linked haven't done it, but some I saw were uploading long-plays of games split into many parts, I guess to easily pad out their total number of videos. Another thing they were doing at the time, was changing their channel name and banner after a few weeks or months and then emailing again pretending to be a whole new channel. Easy to spot if you still had the old link and it was the same. The second one I linked also mysteriously turns Russian if you scroll back far enough. Bit unusual for someone with their location listed as USA.

smnplk 2y ago

The solution is blockchain! /s

belter 2y ago

> Great that we'll finally get state-sponsored open-source development :D Suspicions are very old: "Report of FBI back door roils OpenBSD community" (2010)- https://www.cnet.com/news/privacy/report-of-fbi-back-door-roils-openbsd-community/ https://www.cnet.com/news/privacy/report-of-fbi-back-door-ro...

wongarsu 2y ago
Also TOR being overtly created and sponsored by the US government, leading to some distrust

d0mine 2y ago

Or even better: push a cryptographic protocol with a builtin weakness as a standard and deprecate others as "insecure." Any implementation would be vulnerable.

deleted 2y ago

[deleted]