News for hackers. Stuff that matters.

A comment on Alert for Social Engineering Takeovers of Open Source Projects. Parent comment

Re:Alert for Social Engineering Takeovers of Open Source Pro... by PartiallyTyped on Sunday May 05, 2024 @05:43PM (#40268739)
> Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it.

The rust project does it. There's a repo with all [active] members and their permissions on github, etc. These get synchronized and updated every time there's a change.

[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by GauntletWizard on Sunday May 05, 2024 @05:53PM (#40268835)
This is, in my eyes, one of the most important parts of "Infrastructure as Code". You should make the list of who has what permissions a critical artifact, as immutably part of the repo as any other change.
[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by andix on Sunday May 05, 2024 @05:56PM (#40268861)
Just for the main project, or for all/most packages on crates.io?
[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by PartiallyTyped on Sunday May 05, 2024 @06:41PM (#40269271)
Every repository and team under rust-lang on github.
[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by andix on Sunday May 05, 2024 @06:46PM (#40269305)
That's great, but I think that's not enough. This would need to extend to crates.io, I'm sure there are some packages, that are very commonly used and not part of rust-lang.
[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by guappa on Monday May 06, 2024 @02:29AM (#40271763)
The major projects aren't on github.
[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by PartiallyTyped on Tuesday May 07, 2024 @04:40PM (#40291187)
Could you elaborate?
[ Parent | on HN ]