Good on Kenneth for being quick on the draw. I love 'requests'.
If you're a developer of a popular open-source project, this should serve as a warning to make sure you have multi-factor authentication on, yes, but it's even better to learn from this and come up with incident response plans with your core maintainer base. Ask among yourselves:
1. Do we have the ability to detect an overt breach like this one?
2. Do we have the ability to detect a covert breach (e.g. are our builds reproducible, auditable? Are our binaries signed? Do we know who our committers are?)
3. Do we have a consistent way to message users of the project of the compromise?
4. Do we have a way to deprecate/mark as tainted compromised versions of our module/package/application?
GitHub offers some technology to help in this regard. Sign your release tags, at a minimum [1]; sign your commits with developer keys if you're paranoid. [2]
As FOSS becomes more used in the enterprise, I suspect these attacks will become less of a rarity.
Comments
Good on Kenneth for being quick on the draw. I love 'requests'.
If you're a developer of a popular open-source project, this should serve as a warning to make sure you have multi-factor authentication on, yes, but it's even better to learn from this and come up with incident response plans with your core maintainer base. Ask among yourselves:
1. Do we have the ability to detect an overt breach like this one?
2. Do we have the ability to detect a covert breach (e.g. are our builds reproducible, auditable? Are our binaries signed? Do we know who our committers are?)
3. Do we have a consistent way to message users of the project of the compromise?
4. Do we have a way to deprecate/mark as tainted compromised versions of our module/package/application?
GitHub offers some technology to help in this regard. Sign your release tags, at a minimum [1]; sign your commits with developer keys if you're paranoid. [2]
As FOSS becomes more used in the enterprise, I suspect these attacks will become less of a rarity.
[1] https://news.ycombinator.com/item?id=11494997
[2] https://help.github.com/articles/signing-commits-using-gpg/