News for hackers. Stuff that matters.

A comment on Alert for Social Engineering Takeovers of Open Source Projects. Parent comment

Re:Alert for Social Engineering Takeovers of Open Source Pro... by triblemaster on Sunday May 05, 2024 @07:31PM (#40269588)
How about simply paying the maintainers and then getting stuff done like the classical business does.
[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by __MatrixMan__ on Sunday May 05, 2024 @10:02PM (#40270458)
Well yes, sounds great, but it doesn't really address the security problem. Now you've just got the bad guys getting two paychecks instead of one and the good guys getting one paycheck instead of zero.
[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by transpute on Sunday May 05, 2024 @10:32PM (#40270619)
> bad guys getting two paychecks instead of one

1 to 2 paychecks = 100% increase.

> good guys getting one paycheck instead of zero

0 to 1 paycheck = infinity increase.

With a known baseline of "good paychecks", financial analytics can pursue identification of "bad paychecks".

[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by armini on Monday May 06, 2024 @12:51AM (#40271227)
One of the biggest risks for companies is securing dormant code, it's perfectly fine for a project to be no longer sexy enough to maintain. Platforms like thanks.dev have already proven how reward & recognition can help promote development in an ecosystem https://www.youtube.com/watch?v=e5FV-AnKPlo&t=1s
[ Parent | on HN ]
Re:Alert for Social Engineering Takeovers of Open Source Pro... by omoikane on Sunday May 05, 2024 @11:19PM (#40270849)
Did you mean: instead of trying to become a maintainer to a trusted open source project, how about bad actors simply bribe the existing maintainer to do their bidding? There would be no maintainer changes in that scenario.

Related, the motivation for trying to gain privileged access to open source projects is to leverage the existing trust associated with that project. A different long game that could be played is to create a new project with the intent on backdooring it a few years down the road, after it has gained sufficient trust.

[ Parent | on HN ]