Re:Alert for Social Engineering Takeovers of Open Source Pro...
by Thorrez on Sunday May 05, 2024 @11:28PM
(#40270877)
I don't see how blocking contributions from people in Russia etc will help. Malicious actors can simply falsely claim to be American. Is GitHub going to start verifying citizenship? Even if GitHub did that, it likely wouldn't be too hard to fake.
Re:Alert for Social Engineering Takeovers of Open Source Pro...
by jen20 on Monday May 06, 2024 @03:31AM
(#40272124)
> Is GitHub going to start verifying citizenship?
As an American company they must presumably already do this to avoid violating sanctions, and least for anyone giving them money. It’s not a huge stretch to imagine they could also do so for free tier users.
Re:Alert for Social Engineering Takeovers of Open Source Pro...
by Thorrez on Tuesday May 07, 2024 @01:00AM
(#40282495)
I don't think they need to verify citizenship. I think IP geolocation is sufficient to comply with sanctions. That's not going to stop a malicious actor though.
Re:Alert for Social Engineering Takeovers of Open Source Pro...
by int_19h on Monday May 06, 2024 @05:02AM
(#40272665)
And to be honest, it's not like getting US citizenship for their agent is difficult for a government agency. The same goes for most other countries.
Keep in mind that most places allow you to literally buy citizenship through investment. The amount you need for a country like US is prohibitive for the vast majority, but, again, is not really a problem for another government.
Re:Alert for Social Engineering Takeovers of Open Source Pro...
by mdavidn on Sunday May 05, 2024 @09:09PM
(#40270178)
Would those countries not have similar concerns about US maintainers? The larger issue is successful projects with too few active maintainers.
Re:Alert for Social Engineering Takeovers of Open Source Pro...
by Palomides on Sunday May 05, 2024 @09:33PM
(#40270295)
this is a wild prediction to make and disturbingly regressive
FOSS is one of the most beautiful examples of supranational collaboration, and is in my experience much more integrated than the web at large, in a way that has nothing to do with "recent inclusive ideologies"
Authors from several countries were already suspicious, such as Iran. Anyone from Russia and China or unknown places are all potential risks now.
Combined with recent inclusive ideologies, it’s gonna cause hard conversations. There will be a furthering in segmenting the Internet. Why fight contributing to an open source project when you could fork it and contribute with your allies?
For true enemies, there’s no risk to licensing or copyright issues. You can merge changes from the original, no problem. China even falls into this as there’s a limited ability for US companies to litigate within the country.
People think the Network State is hot, but at the end of the day, the Internet still has borders.