Hacker News Reader

Comment by avsteele | Hacker News Reader

It would appear that no one knows the RL identity of the bad actor? Or even vouches for them?

It doesn't seem wise to accept contributions to projects which may have security implications from anons. Code contributions clearly can't or aren't independently validated.

View on HN

Please read this email [0] from the original author of xz. Try take his perspective in his described situation.

I also recommend this summary [1].

[0] https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... [1] https://boehs.org/node/everything-i-know-about-the-xz-backdo...

I am not assigning any personal blame or making an accusation of bad judgement on the maintainer.

Taking contributions from anons appears to be common. I am suggesting that should change.

Contributions from anons can and in most cases will be verified by maintainers. The actual problem here is appointing them as maintainers.

EDIT: To be clear, this problem is not directed to the original xz maintainer, but more about how to prevent or reduce such appointments in the first place.

That's a kneejerk reaction that will likely have more negative consequences than positive ones, and it likely wouldn't even have helped in this case. Do you think that sophisticated actors, especially state level actors, aren't capable of giving fake IDs to people? Or to have a web of equally fake identities vouch for someone?

Every project potentially has security implications. A package that's used for compression today could be linked to an SSH server tomorrow. Something as banal as a todo list could be a potential attack vector in the right hands.

I don't know what the solution to this problem is. Better verification of dependencies, certainly, but how? More investment by corporate users of FOSS into security? But no matter what we do, "who's watching the watchmen" will remain a valid question.

I'm actually quite impressed that this was found as quickly as it has, though it makes me wary that there might be other, as yet unfound, such attacks.

Your point is well-taken, but see my reply below. Stopping state-backed level actors might not be possible, but we can make it harder for cyber-criminals.

Has it been shown this is by a state-level actor?

> but we can make it harder for cyber-criminals

Why? Still throwing out the baby with the bathwater. Is there a huge number of problematic open source commits by "cyber criminals"? Would this even stop them? Doubtful. Will this make it harder for bona fide people to contribute? Certainly.

How would that help? In this case the adversary is likely to be a state actor/group with a significant amount of resources available (time, money, talent, secrecy, etc.)

Consider also that in many countries the government can force a honest national to collaborate with them on introducing backdoors to any target. This can happen both in OSS and proprietary software projects btw

What do you propose? What would constitute a meaningful verification of identity that wouldn't create a near insurmountable hurdle for newcomers or those unable to travel?

Passkeys?

How? AFAIK a passkey is just a replacement for a password. If my passkey tells you I can authenticate as john.doe@gmail.com, how does that help with establishing trust and identity?

Maybe combined with biometrics like FaceID?

In Sweden we have the proprietary BankID system, which is linked to one’s ‘personnummer’. (The personnummer is similar to SSN and compulsory for all citizens.)

https://www.bankid.com/en/foretag/secure-digital-identificat...

I think India has something similar?

Not sure if open source developers would be so keen on introducing requirements like that into the development process. Some developers want to keep a low profile and not reveal to much about their AFK identity. And nearly all tech for doing stuff like this is proprietary.

I would want to think it over but off the top of my head:

GitHub could provide this as a service, perhaps using uploads of whatever state/national ID the user is coming from. Give a little 'verified ID' badge. All banks do things like this for new accounts.

Granted this doesn't stop state-actors, but it should be effective against cyber criminals.

I think a system where it was harder for unknowns/newcomers to contribute but had better security is a good tradeoff. Esp. since it is likely this incident is not unique.

National ID or verification by an employer. Both are ubiquitous and probably strong enough to at the very least prevent a significant amount of impersonations or fake accounts, which seem to play a large part in legitimizing or disguising these attacks.

> National ID

How are you going to verify a national ID? By taking a photo of it? What if the photo is edited? By somehow going to the maintainer in person and looking for anti-counterfeiting features in the paper? What if the ID is old enough that it predates these anti-counterfeiting features? Not all countries are Germany.

> or verification by an employer.

What if the maintainer is unemployed? What if the reason the maintainer has enough free time to maintain the package is because they're already retired, and living off their pension or investment returns?

> Both are ubiquitous

From what I've heard in the Internet, some large countries still don't have a national ID.

Some countries have national IDs with public-key encryption. You can use the ID card itself to sign things.

>What if the maintainer is unemployed?

How many actually existing maintainers in particular of security sensitive parts of open source projects don't have at least some record of employment or education, a modern passport or national ID with eID features, some other comparable form of identification or at least say one reputable person in the community who can verify they are who they say they are?

Are we seriously pretending the standards that exist for ordering a beer in a bar can't be met for software security that literally billions of people depend on?

> National ID or verification by an employer.

So just claim that you are verified by your employer? It's fairly easy to setup a web page for a non-existing company...

Reply on news.ycombinator.com