Hacker News Reader

Comment by steve19 | Hacker News Reader

Hypothetically could they force BitBucket to inject code into repos or binary releases? I know git is signed, but how many consumers (who just download and compile) check the git log in the cloned repo actually match the the website?

View on HN

It's one of the questions we're asking ourselves internally at atlassian. The only upside to the law is it was written without any idea of how modern software development works - any backdoor or explicit code injection should be caught at the pull request stage.

You have to move your company abroad or risk losing all your customers.

Move the company abroad and fire all their Australian staff, no less.

They have Australian founders too. That makes things even more tricky. ;)

Probably time for them to call it quits.

What happens when the entire Australian staff get the order? Usually to sneak something in, you just need a clique of about 2-5 staff to write it, approve the change and get it deployed.

If the company is large enough, most won't notice the rogue commit, and if %90 of the company gets the order, well good luck!

If I were some shady Australian spy organization, I wouldn't just demand an employee write some obvious change that rips open a backdoor, I would have my highly qualified spy programmers write a fix to an existing bug (ticket) in a repository, but inject a subtle bug (buffer overflow, unescaped input), then have a junior programmer commit it to the repository. The junior programmer might not even be able to spot the problem.

I'm pretty sure ASIO et al only pushing so hard for this precisely because they are incapable of that fairly mundane level of sophistication. But yes, they could get better at it and we wouldn't know.

This is a very good point. I'd only considered it in the context of an individual.

They can ask your company directly, and anyone at your company, to formulate a method of injection. They don't really care how it seems, so a way to deliver code silently post PR is entirely within scope.

But isn't it bad that the law isn't more specific? As it is right now, couldn't the one issuing the order specify exactly what steps the compelled need to take? I'm sure there are quite a few highly skilled individuals working for the Australian spy agency that could craft a method of implementation for a backdoor with a low possibility of detection. Especially if the compelled needs to disclose internal development and security practices.

I haven't fully understood the law myself, so this is both speculation and a question.

I just wanted to say that I'm really heart-broken about your situation regarding to this silly law.

I hope you come out of it totally fine.

This is my main concern too. Leaving atlassian immediately which is a shame as I use them extensively.

Reply on news.ycombinator.com