4 ms·
> Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Also not talked about a lot - there are many ways to c
by mavelikara 2y ago
> Another thing that was not talked about a lot: There are many ways to compromise existing maintainers.
Also not talked about a lot - there are many ways to compromise existing software engineers who are paid to work on proprietary software systems.
- bee_rider 2y agoIt is a worthwhile reminder. But, source-not-available proprietary systems are just totally hopeless from this point of view, of course an intelligence agency could slip something on. A bored developer at the company could too. Users of this sort of proprietary system have just chosen to have 100% faith for some incomprehensible reason.
- spopejoy 2y agoI don't think that's relevant to this discussion though, as open- and closed-source subversion would seem to follow really different paths. - Open-source subversion has the big advantage of having the code, testing and build processes in the open which allows for the attack surface to be exhaustively studied, whereas closed source requires code exfil, reverse engineering, inside intel on processes etc. - Closed-source subversion can hide in other places -- binaries can be corrupted on a compromised server etc. Seeking to influence the code-based development seems like the hardest road IMO. - Open-source maintenance (at least the kind under discussion here) stops at the maintainer, whereas most corporate dev is in a hierarchy with non-uniform commit authority. None of the same social techniques would apply.