alt Hacker NewsI have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.
Replies
The choice is between code you can validate and code you can't, not code that has malware and code that doesn't.
The problem the article is describing seems to have little to do with open source. There were GitHub repositories that had links added in their READMEs to a zip file containing compiled binaries.
GitHub is not a curated software repository. It's essentially no different from some random stranger linking to some binaries on a forum. (There are communities that seem to have no concerns about running unknown binaries from strangers in forum threads, but I wouldn't recommend it.)
> I have to say, the principle that open-source software can't do anything nefarious because the source is open
No is saying this. I think you have misunderstood the principles of open source. I'd rather be able to verify the code i am running, then it being locked down, propreitery.
I have the possibilty to audit FOSS. Cant do it for propreitery software
Never heard of that principle. I have heard people say that if an open source project was doing something nefarious it would be easier for someone to discover it.
Ironically, one of the promises of AI: enough eyeballs.
The catch is the eyeballs can also be used to generate exploits.
I think that this is becoming increasingly true only for large, well-known repositories, where the maintainers have a lot to lose by doing anything shady. I don't think the React team could get away with doing something like that, for example.
Not true. If statistics offer a “measure” of reality, my guess is that “OS doing nefarious things” must fall between 0,005% and 0,007%. In any case compared to the extracted value it’s … nothing.
Why the hell do you think this is related to open-source software?
this issue was found specifically because these things are open source.
the ethos of open source is that bugs and malicious code are more likely to be spotted.
we’re discussing this on hn right now strictly because the code is open, the abusive code was found because it is open.
abusive people will make abusive software. the problem lies in the fact that despite absolutely having the resources, microsoft won’t do anything about it, not in the fact that we can see the abuse.
the problem is microsoft, yet again.
If all projects on github were closed source with public "trust me bro" binaries the situation would be of course much better.
That's not a principle anyone, that knows anything about software, holds.
What's opensource about this?
- Application.cmd or Launcher.cmd
- loader.exe or luajit.exe or another_name.exe
- random_name.cso or random_name.txt
- lua51.dll
It held up before github became a platform for grifters and having stars attracted VCs.
strawman
The xz backdoor should've been a wake up call for everyone subscribing to the classic cargo cult that "malware can't exist in open-source software". All the payload was submitted through auditable code that was cleverly concealed from review.
> the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons
You've been living on such a principle? That sounds insane, why would something not be nefarious just because you can read the code?
The way I was "raised" by FOSS greybeards screaming at me through web forums, was that any software available on 3rd party websites anyone can upload anything to, will be filled with viruses and malware, and this was early 2000s. Surely people still advocate for this mindset today, when it's even more likely?