251
Inside the failed attempt to backdoor SSH globally - that got caught by chance - Kevin Beaumont (doublepulsar.com)
submitted 2 years ago by to c/opensource@lemmy.ml
24 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 21 points 2 years ago (2 children)

Dude, the issue was found purely by coincidence, it very nearly made it through

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 27 points 2 years ago (1 child)

    Yes, but it didn’t. Has it made it through on closed software? Who knows?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 19 points 2 years ago (3 children)

    My takeaway is more like: This one almost made it through and was caught by accident. How much more backdoors actually were not caught and made it through? I would bet some money on it being more than 0 :(

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 2 years ago

    Yep for sure. But open source at least let's you examine every part of the ecosystem.

    No software is perfect even if all contributors have good intentions and do all due diligence.

    Throw some malice and there is a chance something will get through.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 years ago

    Im not sure why it being caught by accident is a factor here.

    If devs knew what the pitfalls were before coding, there wouldn't be security risks in software.

    Hackers do the same thing. They pen test, and if by chance they find something, they exploit it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 2 years ago

    Also this was a multi year effort that employed very complex knowledge. And still didn't get thru.

    If it's multi year and very complex it's telling that this is what it takes. The bar is very high.

  • permalink
  • fedilink
  • source
  • parent