Thought this was a good read exploring some how the "how and why" including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

you are viewing a single comment's thread
view the rest of the comments

[–] lemmyreader@lemmy.ml 52 points 7 months ago (3 children)

"Paid for by a state actor" Yes, who knows.

Could be a lone "black hat" or a group of "black hats". Who knows.
Could be the result of a lot of public criticism in the news regarding Pegasus spyware. Who knows.
Could be paid by companies without any state actors involved. Who knows.
Could be a lone programmer who wants power or is seeking revenge for some heated mailing list discussion. Who knows.

The question of trust has been mentioned in this case of a sole maintainer with health problems. What I asked myself is : How did this trust develop years ago ? People trusted Linus Torvalds and used the Linux kernel to build Linux distributions with to the point that the Linux kernel became from a tiny hobby thing a giant project. At some point compiling from source code became less fashionable and most people downloaded and installed binaries. New projects started and instead of tar and gzip things like xz and zstd were embraced. When do you trust a person or a project, and who else gets on board of a project ? Nowadays something like :

curl -sSL https://yadayada-flintstones-revival.com | bash

is considered perfectly normal as the default installation of some software. Open source software is cool and has kind of produced a sort of revolution in technology but there is still a lot of work to do.

[–] Jennykichu@lemmy.dbzer0.com 24 points 7 months ago

Strongly doubt it's a lone actor for the reasons already given.

[–] tetris11@lemmy.ml 23 points 7 months ago* (last edited 7 months ago) (2 children)

Boostrapping a full distribution from a 357-byte seed file is possible in GUIX:

https://lemmy.ml/post/8046326

If that seed is compromised, then the whole software stack just won't build.

It's an answer to the "Trusting Trust" problem outlined by Ken Thompson in 1984.

[–] lemmyreader@lemmy.ml 45 points 7 months ago (1 children)

Reading a bit into this https://guix.gnu.org/manual/en/html_node/Binary-Installation.html The irony!

The only requirement is to have GNU tar and Xz.

[–] tetris11@lemmy.ml 7 points 7 months ago

Hahaha! Oh dear

[–] lemmyreader@lemmy.ml 8 points 7 months ago

That's cool. Thank you.

[–] agent_flounder@lemmy.world 4 points 7 months ago* (last edited 7 months ago)

Some of the trust comes from eyes on the project thanks to it being open source. This thing got discovered, after all. Not right away, sure, but before it spread everywhere. Same question of trust applies to commercial software too.

Ideally, PR reviews help with this but smaller projects esp with few contributors may not do much of that. I doubt anyone has spent time understanding the software supply chain (SSC) attack surface of their product but that seems like a good next step. Someone needs to write a tool that scans the SSC repos and flags certain measures like the # of maintainers.

PS: I have the worst allergies I've had in ages today and my brain is in a histamine fog so maybe I shouldn't be trying to think about this stuff right now lol cough uuugh blows nose