 |
| $BLEEBZORX chart |
Most of the world's software infrastructure is, or is based upon, open source. The developers and supporters of some of it, for example the Linux kernel, and the major compilers, are paid by technology companies because they are critical to their business. Other, less visible but similarly critical parts are supported by lone volunteers. Apart from the unfairness, this can lead to serious vulnerabilities. Back in 2018 I wrote about one such vulnerability, the
event-stream hack, in
Securing The Software Supply Chain
The attackers targeted a widely-used, fairly old package that was still being maintained by the original author, a volunteer. They offered to take over what had become a burdensome task, and the offer was accepted. Now, despite the fact that the attacker was just an e-mail address, they were the official maintainer of the package and could authorize changes.
The change they authorized included code to steal cryptocurrencies.
In 2020 I wrote a detailed post about this problem entitled
Supporting Open Source Software. Recently the topic re-surfaced on an e-mail alias I read. But what triggered the post below the fold was that this coincided with yet another fascinating piece from Matt Levine and his laugh-out-loud follow-up the next day.