this post was submitted on 29 Mar 2024
671 points (99.0% liked)
Technology
59589 readers
3376 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
And that's why you cannot trust open source software blindly.
And yet with closed-source software you have no choice but to trust it blindly. At least open source software has people looking at the code.
Bet you anything there were more pairs of eyes on SolarWinds code than this. Sick of this open source bystander effect.
Code scanners check for vulnerabilities not malicious code. Ain't no one running full coverage dynamic scanners to trigger all branches of code on this thing, otherwise this would've been caught immediately
Vulnerabilities are caught and fixed faster in open source projects than closed ones.
Intel: 24 years
Your data is about remediation speed not thoroughness of discovery.
FOSS is substantially faster in both.
There is, it’s Google Fuzz which the maintainer of XZ handily disabled the codeshare for.
Interesting! When? Maybe that can be a metric or requirement before companies or seriously popular projects consider importing upstream code.
https://github.com/google/oss-fuzz/pull/10667
https://github.com/google/oss-fuzz/pull/10667#pullrequestreview-1518981986
Looks like it was a cover up attempt to prevent manual attention and would not have been caught by the automation.
You are an idiot. It's not blind. That's how it was found.
Not having world accessible SSH is the real fix here.
Yeah I nearly panicked for a second there, then I remember noone's getting near that anyway. Back to my relaxing weekend.
From the article...
The fact that it was discovered early due to bad actor sloppiness does not imply that it could not have also been caught prior to wide spread usage via security audits that take place for many enterprise grade Linux distributions.
I think it does though. They call it sloppy, I call it sophisticated. Same reason they major distro is running checking shit out right now.
Opensource = fast detection
Opensource + sloppiness = faster detection
Closedsource = never detected
Closedsource + sloppiness = maybe detected
You can put the pom-poms/rifle down, I'm not attacking open source, not in the slightest. I'm a big believer open source.
But I also know that volunteer work is not always as rigorous as when paid for work is being done.
The only point I'm trying to make in this conversation is getting confirmation if security audits are actually done, or if everyone just thinks they're done because of "Open Source" reasons.
Not really. The most important admin interfaces are the ones you can't lock behind an IP whitelists.
"whitelists good IPs" - OK but what if I need to manage the "good ip" infra, etc
And precisely that's why the exploit was found. If it was a closed source programme, a lone threat actor modifying the code and passing it in a release can happen, and no one will find it out. In that case everyone trusts the internal security team of a closed source company blindly. I really don't see this as an open source issue. These are malicious actors.
As opposed to what? If you said "thats why you cannot trust any software blindly" it would have been not that wrong.
Single point of failure on the lone maintainer of a popular package, vs having to hack an entire company like SolarWinds and make a backdoor that bypasses their entire SDLC. Which is harder?
A better way to compare the two would be a lone dev releasing open source software vs a lone dev releasing closed source. And a company releasing open source vs another company of the same size releasing closed source.
SolarWinds since they've already been hacked?
SolarWinds had garbage infosec but you gotta admit the attack chain is much longer and more complex than "kidnap one guy".
There's plenty of closed source packages or components with a single actor ultimately accountable for it.
Imagine a tester even bothering to open a bug that starting a session takes 500ms longer to start than it used to. Imagine what the development manager is going to do with that defect. Imagine a customer complaining about that and the answer the company will give. At best they might identify the problematic component then ask the sole maintainer to give the "working as designed" explanation, and that explanation won't be held to scrutiny, because at that point it's just a super minor performance complaint.
No, closed source is every bit as susceptible, of not more so because management is constantly trying to make all those tech people stop wasting time on little stuff that doesn't matter, and no one outside is allowed to volunteer their interest in investigating.
Checking time to login is more likely in the security sector than anywhere else. A number of vulnerabilities based on timing have been identified and removed in the past.
This is one hell of a take.
Certainly one of the takes of all time.
Imagine trying to make a helpdesk of a proprietary company take your "it's taking 0.5 seconds longer to login" complaint seriously...
So many vulnerabilities were found due to time to login that one of the security features was to take longer to respond to a bad login so they couldn't tell what part failed. Here's an article I found about one such vulnerability.
s/open source software/anything/
Reflections on Trusting Trust
- paper by Ken Tompson, 1984(not that one)
You can trust blindly whatever software you like. Most of us, even those that can code, trust blindly whatever software we use because we have other priorities. But what you can do only with open source software, is open your eyes if you choose.
Ftfy: And that's why you cannot trust people blindly.
Just because we cant observe the code of proprietary software and is sold legally doesn’t mean its all safe. Genuinely I distrust anything with a profit incentive.
What an oblivious attitude
Yep, you're not wrong.