5 ms·

can you provide a relevant example for this context?

dylan604 2y ago
How long did the log4j exist? https://www.csoonline.com/article/571797/the-apache-log4j-vulnerabilities-a-timeline.html https://www.csoonline.com/article/571797/the-apache-log4j-vu... What was the other package that had the mysterious .?
- timschmidt 2y ago
  And yet they were found. How many such exploits lurk unexamined in proprietary codebases?
  - dylan604 2y ago
    yet you say this like Apple or Google or Microsoft has never released an update to address a security vuln
    - timschmidt 2y ago
      Apple[1], Google[2], and Microsoft[3] you say? You say this as if being shamed into patching the occasional vuln is equivalent to security best practices. Open code which can be independently audited is only a baseline for trustworthy code. A baseline none of those three meet. And one which by itself is insufficient to counter a reflections on trusting trust style attack. For that you need open code, diverse open build toolchains, and reproducible builds. None of which is being done by those three. Are you getting your ideas about security from the marketing department? 1: https://arstechnica.com/security/2024/03/hackers-can-extract-secret-encryption-keys-from-apples-mac-chips/ https://arstechnica.com/security/2024/03/hackers-can-extract... 2: https://www.wired.com/story/google-android-pixel-showcase-vulnerability/ https://www.wired.com/story/google-android-pixel-showcase-vu... 3: https://blog.morphisec.com/5-ntlm-vulnerabilities-unpatched-privilege-escalation-threats-in-microsoft https://blog.morphisec.com/5-ntlm-vulnerabilities-unpatched-...
      - dylan604 2y ago
        Go ahead and put that cup of kool-aid down for a minute. There are so so many OSS packages out there that have never been audited? Why not? Because people have better things to do. How many packages have you audited? Personally, I don't have the skillz to do that. The people that do expect to be compensated for their efforts. That's why so many OSS packges have vulns that go unnoticed until after they are exploited, which is the same thing as closed source. OSS is not the panacea that everyone touts it to be.
        timschmidt 2y ago
        > There are so so many OSS packages out there that have never been audited? Why not? Because people have better things to do. I'm not aware of any major open source projects that haven't experienced some level of auditing. Coverity alone scans everything you're likely to find in a distribution like Debian or Fedora: https://scan.coverity.com/o/oss_success_stories https://scan.coverity.com/o/oss_success_stories > How many packages have you audited? Several on which I depend. And I'm just one pair of eyeballs. > Personally, I don't have the skillz to do that. Then why are you commenting about it? > OSS is not the panacea that everyone touts it to be. I don't know who's touting it as a panacea, seems like a strawman you've erected. It's a necessary pre-requisite without which best practices aren't possible or verifiable.
hn3er1q 2y ago
That was an entire body of research at the University of Minnesota and the “hypocrite commits” weren’t found until the authors pointed people to them. https://www.theverge.com/2021/4/30/22410164/linux-kernel-university-of-minnesota-banned-open-source https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...

How long did the log4j exist? https://www.csoonline.com/article/571797/the-apache-log4j-vulnerabilities-a-timeline.html https://www.csoonline.com/article/571797/the-apache-log4j-vu... What was the other package that had the mysterious .?

timschmidt 2y ago
And yet they were found. How many such exploits lurk unexamined in proprietary codebases?
- dylan604 2y ago
  yet you say this like Apple or Google or Microsoft has never released an update to address a security vuln
  - timschmidt 2y ago
    Apple[1], Google[2], and Microsoft[3] you say? You say this as if being shamed into patching the occasional vuln is equivalent to security best practices. Open code which can be independently audited is only a baseline for trustworthy code. A baseline none of those three meet. And one which by itself is insufficient to counter a reflections on trusting trust style attack. For that you need open code, diverse open build toolchains, and reproducible builds. None of which is being done by those three. Are you getting your ideas about security from the marketing department? 1: https://arstechnica.com/security/2024/03/hackers-can-extract-secret-encryption-keys-from-apples-mac-chips/ https://arstechnica.com/security/2024/03/hackers-can-extract... 2: https://www.wired.com/story/google-android-pixel-showcase-vulnerability/ https://www.wired.com/story/google-android-pixel-showcase-vu... 3: https://blog.morphisec.com/5-ntlm-vulnerabilities-unpatched-privilege-escalation-threats-in-microsoft https://blog.morphisec.com/5-ntlm-vulnerabilities-unpatched-...
    - dylan604 2y ago
      Go ahead and put that cup of kool-aid down for a minute. There are so so many OSS packages out there that have never been audited? Why not? Because people have better things to do. How many packages have you audited? Personally, I don't have the skillz to do that. The people that do expect to be compensated for their efforts. That's why so many OSS packges have vulns that go unnoticed until after they are exploited, which is the same thing as closed source. OSS is not the panacea that everyone touts it to be.
      - timschmidt 2y ago
        > There are so so many OSS packages out there that have never been audited? Why not? Because people have better things to do. I'm not aware of any major open source projects that haven't experienced some level of auditing. Coverity alone scans everything you're likely to find in a distribution like Debian or Fedora: https://scan.coverity.com/o/oss_success_stories https://scan.coverity.com/o/oss_success_stories > How many packages have you audited? Several on which I depend. And I'm just one pair of eyeballs. > Personally, I don't have the skillz to do that. Then why are you commenting about it? > OSS is not the panacea that everyone touts it to be. I don't know who's touting it as a panacea, seems like a strawman you've erected. It's a necessary pre-requisite without which best practices aren't possible or verifiable.

hn3er1q 2y ago

That was an entire body of research at the University of Minnesota and the “hypocrite commits” weren’t found until the authors pointed people to them. https://www.theverge.com/2021/4/30/22410164/linux-kernel-university-of-minnesota-banned-open-source https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...