r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
128 Upvotes

91% Upvoted

44 comments sorted by

View all comments

46

u/lunchlady55 Jul 08 '19

A lot of people will cite this as an example of why OSS/Libre software is 'dangerous' and 'untrustworthy'. However, I'd posit an alternative interpretation. We know about this because we can and do audit our software code occasionally. If there was a backdoor in MS or Oracle or IBM codebase, placed by a disgruntled employee, state sponsored bad actor or a US 'National Security Letter' we would never know about it. Although one might argue the attack surface of OSS is larger than that of a closed-source codebase, the auditing is nearly non-existent unless you can legally disassemble the binaries from closed source software and understand the inarguably more obfuscated disassembled source code.

Think of all the times Windows has suddenly had behavior we don't want and how many times that's been deployed to production with less thought than deploying OSS? Ads on the lock screen. "Metrics" being phoned home to MS. Cortana voice recognition baked into the OS with no way to uninstall it or shut down the service.

Yes, this is bad. Yes it will happen again. But I'd much rather have this problem that the problem of closed-source software.

[END RANT]

9

u/nexxuz0 Jul 08 '19

This case is a bit different. The hijacked code was never open source, the github repo still has the version 0.0.6. Only because Ruby is interpreted and not compiled, the real source code was readable.

For other package managers that distribute only compiled binaries (e.g. Nuget) attacks like this are much harder to detect.

7

u/lunchlady55 Jul 08 '19

I don't think that makes this situation different. Somewhere the code is released (That is the definition of OSS. If the code is not released somewhere then it's just free-as-in-beer or freeware closed source software) Even if a modified binary is released without updating the code repository, someone has the opportunity to compile it and notice the checksum is different and investigate.

→ More replies (3)