3 ms·
Let me demonstrate the issue to you with a hypothetical situation: An anonymous open source developer of a popular tool is identified by a bad actor. This deve
by parl_match 2y ago
Let me demonstrate the issue to you with a hypothetical situation:
An anonymous open source developer of a popular tool is identified by a bad actor. This developer is offered a million dollars to install a backdoor that allows the bad actor access to any device used by consumers or that software product.
Now, if that developer is anonymous to you, you have no legal recourse after the developer used their software product to launch a cyber attack on you.
That is the issue.
Also, not hypothetical, many such cases: https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/ https://arstechnica.com/security/2025/01/dozens-of-backdoore...
- autoexec 2y ago> Now, if that developer is anonymous to you, you have no legal recourse after the developer used their software product to launch a cyber attack on you. It looks like the source is hosted on codeberg, which a company in Germany. Presumably they would know which account was used to sign in and upload the malicious code, and that account would be tied to things like an email address and IP address which could be traced back to a person. It might not always be enough to find the person, but that's always true. Red Hat and The Debian Project being non-anonymous didn't mean they knew who backdoored the XZ Utils package.
- pseudalopex 2y ago> Presumably they would know which account was used to sign in and upload the malicious code, and that account would be tied to things like an email address and IP address which could be traced back to a person. Anonymous email services and VPNs exist.
- parl_match 2y ago"It looks like" "Presumably" "might not always be enough"