News for hackers. Stuff that matters.

A comment on We see Project Pegasus, we must have Open Source Smartphones: let’s discuss. Parent comment

Re:We see Project Pegasus, we must have Open Source Smartpho... by cassianoleal on Monday July 19, 2021 @08:02AM (#27881641)
That may be so, but it's usually been through code reviews, pull requests and whatnot - which means a maintainer somewhere has approved that code.

In any case, "a random nickname on the Internet, using a computer somewhere in the globe" is a lot more information than none.

Finding out that that's the case for a given project is part of traceability.

[ Parent | on HN ]
Re:We see Project Pegasus, we must have Open Source Smartpho... by pjmlp on Monday July 19, 2021 @08:43AM (#27881992)
How do ensure it wasn't a malicious maintainer?

That information is meaningless if traces back to an empty room.

[ Parent | on HN ]
Re:We see Project Pegasus, we must have Open Source Smartpho... by cassianoleal on Tuesday July 20, 2021 @06:54AM (#27892194)
If the project has a malicious maintainer, it's easier to find out if it's in the open - and either forcing change or not using the project at all. It's impossible to do that when you have no access to that information in the first place.

It's not perfect but it's something vs nothing. I'll take something every time.

[ Parent | on HN ]
Re:We see Project Pegasus, we must have Open Source Smartpho... by pjmlp on Tuesday July 20, 2021 @08:06AM (#27892739)
How do you track down a malicious maintainer, introducing a back door slowly during one year long, a little change at a time, given how long CVEs in OpenSSL have been unnoticed as example?
[ Parent | on HN ]