Hacker News Reader

Comment by Animats | Hacker News Reader

Does Juniper not have source control? Don't they know who inserted this code?

Lots of source control systems don't offer that level of verification. Even Git, with SHA-1 hashes everywhere, lets you claim to be anybody when you write a commit. The only thing you can verify the origin of in Git is the author of a tag signature, for tags that are signed with a PGP key.

Well, that's the commit. Usually the "push" operation to the origin is auth'd, isn't it?

In most common configurations, authenticated but not logged, and there is no association between the push origin and the contents. If multiple employees have push access to a common repo, then Alice can push a commit which claims to be written by Bob, and nobody would probably notice, and there would be very little forensic evidence, if any.

Which is why commercial crypto and git should never be in the same room together.

What do you recommend instead?

> nobody would probably notice

Really? Most two-bit cat selfie startups are at least aware enough to notice a phantom commit from Bob, but Juniper isn't?!

Doesn't it depend on how good their code reviews and release engineers are? You also forget how the negative attributes of big corporations (eg. size, bureaucracy, etc) can make it difficult to notice a phantom commit from Bob, especially if Bob is asleep at the wheel or not motivated.

'Minor changes'

> In more recent versions of Git (v1.7.9 and above), you can now also sign individual commits.

https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

does this resolve the issue for git? or is it still possible to subvert?

That only solves authentication, not authorization.

So you can trace for sure who made every commit, but you're saying an unauthorized actor can add a commit? Well you would detect that in the code review before the release.

git supports signed pushes as well as signed commits and tags. The signed pushes thing had a vulnerability though:

http://mikegerwitz.com/papers/git-horror-story https://developer.atlassian.com/blog/2015/05/git-horror-stor...

"even git"?

I'm not sure git is the best example of a secure system. Commercial source control systems have more serious authentication.

"Even git" because Git is known to use cryptographic hashes and cryptographically signed tags to verify contents, whereas older systems like SVN and CVS had no such structure.

Yeah but what I think he means is that in any field were security is important svn and cvs aren't relevant in anyway. Compared to other in that area, git is not the best.

Of course, OpenBSD uses CVS exclusively.

So another poster mentioned Perforce. Which "others" are you referring to?

What do they use?

Probably something with Dual_EC in it...

"Commercial source control systems" are usually a steaming piece of crap and I take git over anything that was bought by the higher-ups in ties

Indeed. Serious players use Perforce and consider it to be worth every penny.

But it certainly was universally hated by the developers at my last employer.

The perforce website just talks about git. Does the old perforce vcs thing still exist?

Yes. Their git stuff is a front-end so users can use git, which then funnels it to the back end. Works like Git-TFS or the built-in integration of Git into Visual Studio.

What used to be the central p4 server was renamed Helix, turned into a federated architecture, and there's some sort of data exfiltration protection option that is based on Interset's behavioral analytics stuff.

As far as I can tell from the marketing materials, the idea seems to be that if if a coder starts regularly looking at the sales numbers, file a report. Maybe someone needs a reminder about the consequences of insider trading, but maybe they just want to know if the project's getting traction in the real world, and the false alarm can be resolved with a brief chat. If someone tries to clone an entire corporate monorepo on a salesperson's workstation at 3 in the morning local time, shut it down, because the most likely explanation is that the salesperson's workstation has been compromised.

One would hope. Yet, SCM security is so lax and such an afterthought that Wheeler had to write a whole piece on it:

http://www.dwheeler.com/essays/scm-security.html

After all that, only one OSS project responded with claims to meet many of the requirements. I figure the commercial situation isn't much better with most "benefits" existing on paper rather than with strong security.

To top it off, anyone defending against nation-states must remember they always attack what's below and around the software. Possessing 0-days in OS or management software should let them bypass build-system security to insert stuff in. I'd say OpenBSD, memory-safe implementation, and highly-assured guard for protocol-level at a minimum if better stuff wasn't available.

Reply on news.ycombinator.com