Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by groby_b on Friday March 29, 2024 @08:08PM (#39870419)

IIRC, kuro5hin and others all left out a crucial step in the web-of-trust approach: There were absolutely no repercussions when you extended trust to somebody who later turned out to be a bad actor.

It considers trust to be an individual metric instead of leaning more into the graph.

(There are other issues, e.g. the fact that "trust" isn't a universal metric either, but context dependent. There are folks whom you'd absolutely trust to e.g. do great & reliable work in a security context, but you'd still not hand them the keys to your car)

At least kuro5hin modeled a degradation of trust over time, which most models still skip.

It'd be a useful thing, but we have a long way to go before there's a working version.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Thursday April 04, 2024 @05:26AM (#39928222)

Once you add punishment for handing out trust to bad actors, even in good faith (which you can't prove/disprove anyway), then you also need to somehow provide siginificant rewardsf for handing out trust to good actors - otherwise everyone is going to play it safe and not vouch for anyone and your system becomes useless.

[ Parent | on HN ]