Not discrediting Open Source Software, but nothing is 100% safe.

    • rufus@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      Well, i think in most of those big incidents, people got caught. That means the concept kinda works well?

      Regarding the earlier comment: I think companies just started to figure that out. They/You can’t just take free libraries databases etc… If you’re big tech company you better pay a few developers or an audit to make those libraries safe. This is your way of contributing. Otherwise your big platform will get hacked because you just took some 15 year olds open source code.

      • 018118055
        link
        fedilink
        English
        arrow-up
        7
        ·
        1 year ago

        Selection bias though. We don’t know how many have not yet been caught.

        • Freeman@lemmy.pub
          link
          fedilink
          English
          arrow-up
          4
          ·
          1 year ago

          agree. Hell i wouldnt be shocked if some corporations or even nation-state (ie: NSA) actors do this, in a much better/more professional manner to ensure things like…backdoor access.

            • Freeman@lemmy.pub
              link
              fedilink
              English
              arrow-up
              3
              ·
              1 year ago

              Yeha that was my though. But more a dedicated program to do similar with large FOSS projects.

              They also have hardware/supply chain intercept programs to install back doors in closed source appliances (ie: Cisco firewalls)

              So something similar but dedicated to open source PRs.

              • rufus@discuss.tchncs.de
                link
                fedilink
                English
                arrow-up
                2
                ·
                edit-2
                1 year ago

                Yeah. I think the discussion is kind of nonsensical and a tautology. Nothing in life is 100% safe, if foss or not. And we don’t know what we don’t know. We got a few cases where we know something got intercepted after people tried to do malicious PRs or intercepted network equipment.

                • 018118055
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  1 year ago

                  I think the more interesting question has long been: what’s (or who is) your threat? Against a sufficiently motivated and resourced adversary, there are few real obstacles. Conversely, some people are just not interesting because there’s little or nothing to gain from attacking them.

                  • rufus@discuss.tchncs.de
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    ·
                    edit-2
                    1 year ago

                    Exactly. I just wanted to point out that most of the people here honestly have no idea what they’re talking about.

                    If people had read the articles about that ‘study’ if malicious pull requests got accepted… and the aftermath… If they had read the articles how the NSA(?) helped(?!) with the mathematical constants of elliptic curve encryption… How cisco networking equipment got intercepted… If you knew how the internet and freedom worked… You’d know it’s not that easy. Every ‘simple’ answer is just plain wrong. It depends… What is the thread model, what are you able and willing to invest, what are you trying to achieve? Sometimes you don’t even know who’s friend or foe.

                    Idk why people want to piss on open source software. It’s a fact that one can have a look at open source software and not at closed source. And don’t tell me nobody does, because i know i do. And millions of github users contribute code and read some code here and there. And i know a few tech blogs who like to check apps and see if they respect privacy and so on. … And that’s not everything as we pointed out earlier. If this helps you, depends on your own goals and thread model.

              • 018118055
                link
                fedilink
                English
                arrow-up
                2
                ·
                1 year ago

                At least there have been attempts to subvert open standards for cryptography through the standards process. And occasional suspicious pull requests in critical places - I assume those are done through cut-out proxies so we don’t know who tried.