Bullying in Open Source Software Is a Massive Security Vulnerability
Bullying in Open Source Software Is a Massive Security Vulnerability
The Xz backdoor and a near miss on the F-Droid app store show how the entitled attitude of some people in the open source community can be used to push malicious or insecure code.
Closed source projects are also subject to bullying.
Project managers pressuring developers to implement half assed features in an afternoon because sales sold a feature that doesnโt exist and have signed a deal to have it delivered tomorrow morning. Who has time to review the code and ensure there are no SQL injection vulnerabilities? Just push it!
Absolutely. In my experience I've felt more pressure to merge in closed source than open source since the bully is those above you in a hierarchy with business interests who are also paying your bills.
Yeah, honestly, I think this post is just for the hype on the backdoor injection. Open source is the best method to make software, the
xzvulnerability just went to testing versions and were found. Simple, people find it as everyone is doing their little part and contribution to build all this system.If you think closed sources are better, then you are so wrong (like if WhatsApp didn't have a backdoor on their production code, and they're not going to code all open source libraries they are using from zero, too much time, money and people), the post is wrong, closed sources often has more money (the money that they aren't paying for the open source contributors that they're using), and they can pay their marketing to make you feel a "premium" experience while all the crashing and errors are hidden, this is how companies works.
If we check all closed source vulnerabilities and open source vulnerabilities, I'm sure there are many on the closed (and often pretty stupid vulnerabilities/errors), they can use deprecated libraries (updating to newest is always money, and they want to be efficient, if works, don't touch it) without worry.
Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant now
https://social.librem.one/@eighthave/112194828562355097
Steiner wrote this week that the original coder deleted their account as soon as F-Droidโs maintainers attempted to review the code, and that he thinks that the userโs behavior, as well as โall the attention from random new accountsโ has led him to believe โit could be a deliberate attempt to insert the vuln.โ
This is pretty significant: the first documented case of these tactics being used to insert a vulnerability, apart from xz. So probably the same actors have been trying this on multiple projects.
I hope other maintainers who have experienced similar pressure tactics will come forward, even if they're not aware of any backdoors. For any project where this has taken place and the code was merged, the code and commit history needs to be audited.
Thats like "child labor is bad because they cant do high quality work".
Bullying is bad. Period.
You're nitpicking the headline while agreeing with the article.
โWhat is striking is that the uncool, mean standards of FOSS conduct that many of us have decried for years, and that many defended as authentic, tough, etc., ended up not just being exclusionary loser behavior, but a significant attack surface.โ
I fail to see the comparison at all.
Bullying in Closed Source Software is also bad. Off course in Open Source more people have the ability to do this, compared to a more controlled environment like Closed Source. What do we learn from the mistakes described in the article? Don't close your eyes, watch and don't trust untrusted people. If someone starts bullying or is toxic, take that as an attack and warn them to get banned. It's like saying bullying under politicians is bad. Yes it is. And we should not allow that. But that does not mean we should stop using or developing Open Source (or stop electing).
If people are really unhappy with the direction of the project and if they want to push specific updates they want see, they should just fork it and do whatever they want. And if it works, it can still be integrated into the "main app".
One of the takeaways Imo is to consider bullies as potential security threats especially when they're pushing to merge code. And for both developers and non-developers alike, to try to foster a culture of respect and avoid entitlement in git issues. Call it out when you see it and don't dogpile.
People will always be a vulnerability. That goes for physical security too.
Im a former contributor to F-Droid with various merged pull requests. Looking at the indicated pull request I really doubt that it was an intentional attack. First of all its easy to forget for a new developer to escape SQL parameters, and the docs dont even mention a risk of SQL injection attacks. And of the users pushing for the PR to be merged, one is a long-time F-Droid contributor, and the other also looks like a real human with many contributions in other repos, so no sockpuppets in sight.
It simply looks like standard open source behaviour, for better or for worse. A new user makes a contribution for a highly demanded feature, and users want it to get merged as soon as possible. Maintainers are discussing the big picture of the change and want to avoid breaking changes, without getting into code review yet. The new contributor seems unwilling to make any design changes to his PR, and gets frustrated that it doesnt get merged as is. The potential vulnerability is only noticed half a year after the PR was opened, at which point it was already de facto abandoned. So not an attack, but simply a developer who is new to open source and doesnt understand how the process works.
This makes more sense imo, thanks for sharing your experience (and your Lemmy development :))
Plus how would you want to exploit a F-Droid SQL injection vulnerability in the search bar?
AFAIK you cannot trigger searches using URLs, so the user would have to type/paste the SQL into the search field themselves to mess up their database.
One of the comments mentions that another app can trigger search through an Android intent. So its better to be safe and close any potential vulnerabilities, but this doesnt seem particularly useful for an attacker.
This is why I dislike people badgering the Lemmy devs for whatever they feel is currently important to them. "Ermagerd, it's GDPR violation!!!1!!!1!!111". Or people flaming the developer(s) of Mastodon for not implementing quoting "Twitter has it, so you must implement it for people coming from Twitter!". And so on and so forth.
We should all be doing what we can to help opensource developers and that also means calling out shitty behavior from its users or external contributors towards maintainers. Maintainers aren't messiahs and just humans too, so them being cunts isn't nice either (obviously), but I have much more understanding for their behavior sometimes. Especially when hundreds of entitled keyboard warriors attack maintainers and write blog articles about them (like wedistribute.org) demanding stuff be done their way.
Maintainers also need better tools and features from giants like github to shutdown annoying users on their projects. Github's "social" features need a lot of work. It's not possible to have moderators (human or automatic provided by the platform) for projects for example. Instead maintainers have to read all the bullshit demands people have expressed with no filter.
When the maintainer of actix stepped down due to harrassment by rust purists (he used the
unsafekeyword) and there was an outpour of support, it felt so ridiculously fake. It had been going on for a while and there were reddit threads, blog posts, tweets, and other cries on social media by the purists that amounted to harrassment, but only when the maintainer stepped down did people affected react.I'm by far no angel, but at least my claim to fame isn't abusing maintainers enough for them to quit.
At least with Lemmy and Kbin, if you have a feature you want to have implemented you always have the option to fork and host your own instance. Maybe not ideal for everyone, but the option is there.
This has happened to Kbin with the fork Mbin due to inactivity from the main Kbin maintainer. Itโs not ideal that a project goes stale, but life happens and we must respect that.
what? The community finds issues like the XZ one, and the devs say they won't be able to fix it because they have less important things to work on instead.
Its not bullying the devs to point out to them the massive GDPR violations of their software and to give them hell for sweeping it under the rug and literally say they won't do anything to fix it.
I believe this is the article you refer to
https://wedistribute.org/2024/03/lemmy-image-problem/
Its pretty spot-on.
Its not bullying the devs to point out to them the massive GDPR violations of their software and to give them hell for sweeping it under the rug and literally say they wonโt do anything to fix it.
It is. The data is in the DB and filesystem and can be manually removed. Having a button that does it is a convenience. It's the instance operator who will be in trouble if they don't. The code is provided with a license that literally says
THERE IS NO WARRANTY FOR THE PROGRAM
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES
You are using it and/or hosting it at your own peril.
And the devs said this
So there is no legal nor moral responsibility to implement any features that you personally want. However you are free to:
- Implement the feature yourself
- Pay someone else to implement it
- Stop using Lemmy and use one of countless alternative platforms instead
Then the fediverse erupted and made blog posts, toots, @'ed the devs directly, etc.
Also Open Source Maintainers Owe You Nothing. Interalise that. They owe use fucking nothing - except maybe the respect we show them and if none is shown, they don't owe any respect back.
Anti Commercial AI thingy
If something is free Software, there is no supply chain. There is no security and no guarantees. For sure all these volunteers are mostly trying to deliver a good product, but they are offering free labor.
Saying "bullying is bad for the outcome of the product" is kinda ironic, as "not paying these devs" also is bad. This is just the extreme form
This person has never worked in a company where customer service has full access to userโs passwords because no one bothered to hash them.
What? Its literally a transparent supply chain, and therefore much safer than the supply chain of non-free software.
So what is the the solution then? What kind of culture would be more operationally secure?
I think the article was pretty clear that (1) companies that use open source projects to make money should be contributing financially to them, and (2) users and contributors need to stop feeling entitled to maintainers' unpaid labor and time. Mostly 2 because it's a security risk AND a shitty way to treat people who are making something free for you.
users and contributors need to stop feeling entitled to maintainersโ unpaid labor and time
And the rest of us need to stand up for maintainers against bullies.
Honestly, in medium to big projects, 2 seems like mostly astroturfing from companies who really want to hide the fact that they benefit financially but use alt accounts to push toxic bullying like "you're not following opensource principle, not foss this, not foss that, you do this or we're going to make a scene" when maintainers try to get any semblance of authority over their own projects.
Maybe some inspiration from how OpenBSD handles users requesting features.
"No one deserves anything from us. /../ The developers in this project do the best they can"
or
"If you expected any of us to reply as if we are contractors or your employees, you came to the wrong place."Community guidelines in a readme would be a good start. Also, educating those opening new git issues since I often see entitled and vitriolic demands from non-devs who do not understand what FOSS is (although I understand that this isn't the only bully archetype).
Probably some sort of mix, like federated or crowd-sourcing, but either simply means more maintainers/supervisors.
I had a project I gave up and dropped because of the general OSS community being crap.
There were a lot of supporters, but got tired of all the wankers I had to defend the project from. It simply wasn't worth it when I was putting in so much time for free
So, I agree entirely.
It's not everyone, but we do have a lot of donkeys out there honestly, and i suspect it has a bigger impact on the development community than we know
The issue is, as always, the non donkeys not calling out the donkeys.
If you see someone bullying someone else, online of offline, you intervene. Thats basic decency and everyone who doesnt do that is part of the problem.
Someone calling a person names, trolling them or otherwise being an ass should be met with a wall of reports and differing opinions.
Bullying others is only fun if you can do so uninterrupted. More compassion, folks.
My hair stood up straight due to an ad on that website playing music.. A blast from the past!
What browser and ad blocker are you using that you're getting ads and autoplay isn't blocked?
Mostly using duck duck go. But am considering Firefox with some addons now.