Alert for Social Engineering Takeovers of Open Source Projects

Re:Alert for Social Engineering Takeovers of Open Source Pro... by Thorrez on Sunday May 05, 2024 @11:28PM (#40270877)

I don't see how blocking contributions from people in Russia etc will help. Malicious actors can simply falsely claim to be American. Is GitHub going to start verifying citizenship? Even if GitHub did that, it likely wouldn't be too hard to fake.

[ Parent | on HN ]

Re:Alert for Social Engineering Takeovers of Open Source Pro... by jen20 on Monday May 06, 2024 @03:31AM (#40272124)

> Is GitHub going to start verifying citizenship?

As an American company they must presumably already do this to avoid violating sanctions, and least for anyone giving them money. It’s not a huge stretch to imagine they could also do so for free tier users.

[ Parent | on HN ]

Re:Alert for Social Engineering Takeovers of Open Source Pro... by Thorrez on Tuesday May 07, 2024 @01:00AM (#40282495)

I don't think they need to verify citizenship. I think IP geolocation is sufficient to comply with sanctions. That's not going to stop a malicious actor though.

[ Parent | on HN ]

Re:Alert for Social Engineering Takeovers of Open Source Pro... by int_19h on Monday May 06, 2024 @05:02AM (#40272665)

And to be honest, it's not like getting US citizenship for their agent is difficult for a government agency. The same goes for most other countries.

Keep in mind that most places allow you to literally buy citizenship through investment. The amount you need for a country like US is prohibitive for the vast majority, but, again, is not really a problem for another government.

[ Parent | on HN ]