2 ms·

> The major short term downside is that open source or personal projects won't be able to afford things like Codex Security. Realistically, all open-source pro

by nullbio 5mo ago

> The major short term downside is that open source or personal projects won't be able to afford things like Codex Security. Realistically, all open-source projects should be forced to have automated scans of this nature before their releases can be shipped. This is something the package managers and github need to figure out. It'd stop the supply chain attacks too.

05 5mo ago
> It'd stop the supply chain attacks too. Yeah it’s hard to write a loop that makes an adversary agent write and mask malware then runs a scanning agent and if the malware is detected gives the detection details to the adversary agent with instructions to hide it better.. As usual, the attacker only needs to get lucky once.
junon 5mo ago
> all open-source projects should be forced That's a great way to kill OSS. This is only bootlicking the idea of corporations profiting off of unpaid labor.
- nullbio 5mo ago
  Well something needs to be done urgently, before hospitals and critical infrastructure start getting ransomware infected on a daily basis. This isn't an unlikely scenario either, all it will take is one well resourced attacker to spin up thousands of decensored agents and have them pumping out attacks 24/7. I'm actually kind of surprised it hasn't already happened. TeamPCP is just the beginning. We're lucky they're not using ransomware, otherwise the carnage would be 100-fold.
  - junon 5mo ago
    Then the corporations, medical system, etc needs to help support the people who make OSS software if they want the immediate, urgent change you're suggesting.
qerahb 5mo ago
So first they steal all code and launder it without attribution. Then they release a tool that doesn't find anything in hardened projects and is marketed through secrecy and modern equivalents of Netcraft like this British AI institute. Then open source projects need a McKinsey-like stamp of approval to even be released. Sounds like there are many parasites in this process. You know that open source users are free to scan everything if they want to?
- nullbio 5mo ago
  I don't like it either. But what alternative is there when a spaghetti graph of open-source dependencies serves as the backbone for the entire worlds software? I haven't seen or heard of any novel solutions to this problem yet.

by nullbio 5mo ago

05 5mo ago

> It'd stop the supply chain attacks too. Yeah it’s hard to write a loop that makes an adversary agent write and mask malware then runs a scanning agent and if the malware is detected gives the detection details to the adversary agent with instructions to hide it better.. As usual, the attacker only needs to get lucky once.

junon 5mo ago

> all open-source projects should be forced That's a great way to kill OSS. This is only bootlicking the idea of corporations profiting off of unpaid labor.

nullbio 5mo ago
Well something needs to be done urgently, before hospitals and critical infrastructure start getting ransomware infected on a daily basis. This isn't an unlikely scenario either, all it will take is one well resourced attacker to spin up thousands of decensored agents and have them pumping out attacks 24/7. I'm actually kind of surprised it hasn't already happened. TeamPCP is just the beginning. We're lucky they're not using ransomware, otherwise the carnage would be 100-fold.
- junon 5mo ago
  Then the corporations, medical system, etc needs to help support the people who make OSS software if they want the immediate, urgent change you're suggesting.

qerahb 5mo ago

So first they steal all code and launder it without attribution. Then they release a tool that doesn't find anything in hardened projects and is marketed through secrecy and modern equivalents of Netcraft like this British AI institute. Then open source projects need a McKinsey-like stamp of approval to even be released. Sounds like there are many parasites in this process. You know that open source users are free to scan everything if they want to?

nullbio 5mo ago
I don't like it either. But what alternative is there when a spaghetti graph of open-source dependencies serves as the backbone for the entire worlds software? I haven't seen or heard of any novel solutions to this problem yet.