Comment by Godel_unicode | Hacker News Reader

Comment by Godel_unicode | Hacker News Reader

Parent Full thread

The point of "... trusting trust" is not really the specific bug, but rather the observation that the whole supply chain matters. Built artifacts as exist on disk in the repo are a relatively small piece of that.

> None of those package repositories are maintained by a limited set of curators.

It's always interesting to me how few people seemingly know this. Python package maintainers realize how easy it is to add packages to PyPI, but many admins and even SOC operators inherently trust it because they think that it "must be reviewed by someone".

Also, there have been plenty of security issues with Ubuntu and Debian: https://wiki.ubuntu.com/UbuntuWeeklyNewsletter/Issue52#Commu... https://www.linuxinsider.com/story/32240.html

Also there have been bugs in apt: https://www.fosslinux.com/6167/massive-security-bug-found-in...

Also the official ISO from the Mint website: https://arstechnica.com/information-technology/2016/02/linux...

Also the AUR malware mentioned on thread: https://www.bleepingcomputer.com/news/security/malware-found...

Also the kernel.org compromise: https://www.zdnet.com/article/linux-kernel-source-code-repos...

Edit: let's throw in the redhat ceph intrusion while we're at it (note that this includes InkTank). https://www.zdnet.com/article/red-hats-ceph-and-inktank-code...

I don't like when "Reflections on trusting trust" is used as an excuse to throw the hands in the air and not doing anything. Sure, it's not perfect, but the reproducible-builds people are doing important work that makes it considerably harder to inject malware into distribution repos.

I'm sorry, but the logical fallacy of "We must do something; This is something; Therefore, we must do this." is the worst attitude to have for security. Not only you will never end with anything actually important done, it will also justify all the evil that will be done in the name of security.

And nobody says that not doing anything is ok, but please do it properly, do some basic threat modeling first.

P.S. I'm not against reproducible builds, I think they are useful for many things, just not for security. They may even let us do decentralized trustless peer-to-peer build system someday.

The hard part about the security of built artifacts is not building them, it's auditing the source looking for bugs. Reproducible-builds doesn't audit the source, but many act like they think it does. Added to this is the host of other security issues with the chain between the developers keyboard and your system. This solves none of them, but many act like they think it does.

Therefore, in my view it provides a smallish real benefit and a large moral hazard.

> The point of "... trusting trust" is not really the specific bug, but rather the observation that the whole supply chain matters.

There's a really fascinating project by the authors of TUF called in-toto[1] that addresses exactly this problem.

[1] https://in-toto.github.io/

Science is hard. Superstition is fast and might save your job, at least for awhile.

I want this on a shirt.

Reply on news.ycombinator.com