Hacker News Reader

Comment by pokepim | Hacker News Reader

How can we protect against people like RIAEvnagelist and whole node-ipc fiasco who undermine whole point of OSS? Imagine if public admin app uses some library written by lunatic? Whole goverment system can be target of such terrorist attack.

View on HN

By having reputable sources. And most likely having people reviewing upgrades, what you're installing and what the building code is doing (and running it in a sandbox). This role is usually taken by the distribution's packagers. As some kind of users cooperative, distribution have very distinct incentives from software vendors. This separation has been eroded with the advent of self-publishing "app stores" (like the commercial ones, but also by npm, pypi, crates.io etc, and by flathub or snapcraft). See [1] and [2] from DeVault on this topic. This topic has been solved, it just needs manpower. And just because major distributions have some perceived bureaucratic overhead doesn't mean it's an intrinsic caracteristic. Official repos on arch, alpine and probably tons of other distribs are actually updated really quick and really simply (and still sometimes have patches applied to them, or support files, etc).

[1] https://drewdevault.com/2019/12/09/Developers-shouldnt-distr...

[2] https://drewdevault.com/2021/09/27/Let-distros-do-their-job....

PS: These aren't "terrorist attacks". It's quite emotional, judgmental and not very precise nor meaningful. Some random dude pushed malware in a supply-chain attack. From wikipedia on terrorism:

> Having the connotation of "something morally wrong", the term "terrorism" is often used to abuse or denounce opposite parties, either governments or non-state groups.

> It is common for both parties in a conflict to describe each other as terrorists.

Well to me it was clearly attempt to wage war against civilians, so the definition should apply. What if that malware ended up in Russian hospital which treated sick children?

Proprietary software is very likely to rely on the same open source dependencies, also using NPM, pypi, etc, with the same baked assumptions that allow for that type of supply chain attack.

Just saying that it’s a systematic problem in the way we use, manage, and consider 3rd party dependencies. And the risk already exist right now, without administration promoting open source software.

(I don’t know how to protect against it at scale)

I had to look up what RIAEvangelist was, but now I've done so, I'm not sure why we need protected from it:

https://github.com/RIAEvangelist/peacenotwar

Seems like it's promoting good software security practices?

At one point node-ipc deleted all files on the filesystem if the user had a Russian/Belarusian IP, they have since made it non-destructive (just adding a file to the desktop).

Nothing on the GitHub repo suggests this is true, can you link to a reliable source for this info?

https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0...

Reply on news.ycombinator.com