Mozilla may treat Aussie staff as 'insider threats' to code base

Re:Mozilla may treat Aussie staff as 'insider threats' to co... by rovyko on Monday February 25, 2019 @06:37AM (#19244868)

Do you think the presence of a code review practices alone will be enough of a deterrent against agencies using devs for this purpose?

Even if you pressure someone to make a backdoor and they get caught, you've just exposed your intentions when it could have been easier to go straight to the company.

[ Parent | on HN ]

Re:Mozilla may treat Aussie staff as 'insider threats' to co... by mikerg87 on Monday February 25, 2019 @10:34AM (#19246320)

I don’t think A PR is the only attack vector. I would be suspect of the entire CI/CD pipeline and any production systems or distribution systems in employed

[ Parent | on HN ]

Re:Mozilla may treat Aussie staff as 'insider threats' to co... by MrEldritch on Monday February 25, 2019 @12:07PM (#19247148)

Also, if I were an Aussie and I'd gotten a request like this, I'd feel pretty incentivized to make the backdoor as blatant and suspicious-looking as possible. The government ordered you to do it; it did not order you to do a good job.

So "evil PR" would probably be the easiest thing to catch, and it definitely seems like other compromise vectors are where the real danger is.

[ Parent | on HN ]

Re:Mozilla may treat Aussie staff as 'insider threats' to co... by noir_lord on Monday February 25, 2019 @12:18PM (#19247292)

    public function rot13_GbgnyylAbgNOnpxqbbe()

Something subtle like that?

Fwiw the UK has near identical legislation and I'm pretty sure the Aussie gov looked at ours first.

We lead the world in subtly corrupting democracy.

[ Parent | on HN ]

Re:Mozilla may treat Aussie staff as 'insider threats' to co... by zuccs on Monday February 25, 2019 @04:48PM (#19249784)

What if you accidentally cast your coding session to your Twitch stream?

[ Parent | on HN ]