Not discrediting Open Source Software, but nothing is 100% safe.

  • Sockenklaus@lemmy.world
    link
    fedilink
    English
    arrow-up
    21
    ·
    1 year ago

    That’s exactly the problem with many open source projects.

    I recently experienced this first hand when submitting some pull requests to Jerboa and following the devs: As long as there is no money funding the project the devs are trying to support the project in their free time which means little to no time for quality control. Mistakes happen… most of them are uncritical but as long as there’s little to no time and expertise to audit code meaningfully and systematically, there will be bugs and these bugs may be critical and security relevant.

      • rufus@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        8
        ·
        1 year ago

        Well, i think in most of those big incidents, people got caught. That means the concept kinda works well?

        Regarding the earlier comment: I think companies just started to figure that out. They/You can’t just take free libraries databases etc… If you’re big tech company you better pay a few developers or an audit to make those libraries safe. This is your way of contributing. Otherwise your big platform will get hacked because you just took some 15 year olds open source code.

        • 018118055
          link
          fedilink
          English
          arrow-up
          7
          ·
          1 year ago

          Selection bias though. We don’t know how many have not yet been caught.

          • Freeman@lemmy.pub
            link
            fedilink
            English
            arrow-up
            4
            ·
            1 year ago

            agree. Hell i wouldnt be shocked if some corporations or even nation-state (ie: NSA) actors do this, in a much better/more professional manner to ensure things like…backdoor access.

              • Freeman@lemmy.pub
                link
                fedilink
                English
                arrow-up
                3
                ·
                1 year ago

                Yeha that was my though. But more a dedicated program to do similar with large FOSS projects.

                They also have hardware/supply chain intercept programs to install back doors in closed source appliances (ie: Cisco firewalls)

                So something similar but dedicated to open source PRs.

                • rufus@discuss.tchncs.de
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  edit-2
                  1 year ago

                  Yeah. I think the discussion is kind of nonsensical and a tautology. Nothing in life is 100% safe, if foss or not. And we don’t know what we don’t know. We got a few cases where we know something got intercepted after people tried to do malicious PRs or intercepted network equipment.

                  • 018118055
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    ·
                    1 year ago

                    I think the more interesting question has long been: what’s (or who is) your threat? Against a sufficiently motivated and resourced adversary, there are few real obstacles. Conversely, some people are just not interesting because there’s little or nothing to gain from attacking them.

                • 018118055
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  1 year ago

                  At least there have been attempts to subvert open standards for cryptography through the standards process. And occasional suspicious pull requests in critical places - I assume those are done through cut-out proxies so we don’t know who tried.

    • Rentlar@lemmy.ca
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      For the human-hours of work that’s put into it it’s very expensive. I put in translations, highlighted bugs, put in a Jerboa fork to help mitigate issues with the 0.18 Lemmy upgrade… if I were to do this kind of thing for work I’d bill 25CAD per hour at the very minimum.