Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> a new contributor

Jia Tan, is that you?




oh no, gentoo has been compromised


I know part of the fun of oss is anyone can contribute behind an anonymous github username, but is this a wake up call for the package owners?

Do we need at least some form of basic identity verification (even in the form of an employer link, LinkedIn, or similar)?


I've argued in a blog post [1] that we need to delineate between "open source developer" and "supplier". If we don't do that, calling thankless unpaid volunteers and hobbyists a "supply chain" is kind of insulting [2].

I don't believe that "identity verification" for F/OSS developers is a good idea. Suppliers? Sure. That can be a contract negotiation when you decide how much you pay for it.

Also, I don't think identity verification helps when your adversary is a nation state, which can just falsify government identification if it suits them.

[1] https://scottarc.blog/2024/04/04/open-source-supply-chains-a...

[2] https://crankysec.com/blog/supply/


Just because it can by beaten doesn’t mean making it harder isn’t useful. This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI.


> Just because it can by beaten doesn’t mean making it harder isn’t useful.

Fair.

> This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI.

I disagree strongly, and am surprised to hear this argument on Hacker News of all places.


People are so used to see artificial bureaucratic structures as more real than their real counterparts that they constantly invent such naive solutions. “Just make the gub'ment provide an official paper (with a stamp) that Joe Random Dude is a real developer, a father of two, not a fan of satanic metal music, and the project will be safe”.


People already do this in a general sense for authenticating a person and deciding if they’re trustworthy.


Not “trustworthy”, but “able to play their role in certain scenes”. When you're outside of that structure, those decorated clothes lose any meaning.


The VPN is just part of the picture (sock puppet accounts complaining about speed of dev, no meaningful history of other contributions from the dev, no trusted "personal network" for the dev, etc) that in hindsight should have raised red flags.


If they constantly are on a VPN and not willing to disclose a real location or IP then I fail to see why they should be trusted when they don’t provide anything trustworthy themselves.


new project idea: OpenBackgroundCheck

volunteer osint researchers attempt to dox any identity you submit, so you can know whether they're the Right Kind of OSS contributor or not.

/s


Most people you interact with electronically, you don't even bother trying to see if they're using a VPN or make any attempt to geolocate them.


Sure but GitHub could have that as a badge to provide useful info that can help with vetting someone who wants to be a maintainer.


Not everyone dev that uses a VPN or something like Tor is doing so due to some malicious reasons. Some people face challenges regarding privacy.


No. I love contributing as my fursona sometimes. I don't want to dox myself to do so.

We shouldn't need to know who you are to be verify that your contribution is trustworthy. Code should stand on its own merits. Ideas like this tend to dovetail into "real name policies", which suck https://www.eff.org/deeplinks/2014/09/facebooks-real-name-po...


Identity is a red herring. Backdoors are intentional vulnerabilities and are discoverable through vulnerability analysis.

You can't solve identity, and real, verified people can still betray you. Even trustworthy people can betray you, either unwillingly or unwittingly.

You can't solve vulnerability analysis either (it's the halting problem), but you also can't shirk it. You might as well go all in on it rather than undermining the basis of open source collaboration and many eyes making bugs shallow.

But it certainly is a wake up call of some kind.


> Do we need at least some form of basic identity verification

For dedicated attackers (as was the case here) that will move the goal posts ever so slightly farther away, but not much else. I see how it's tempting to focus on identity, but I don't see how it's productive.


> Do we need at least some form of basic identity verification (even in the form of an employer link, LinkedIn, or similar)?

Not all free software contributors are employed. They might be too young (it's not unusual to start contributing to free software while still in school), too old and already retired, be part of a family where another family member is the working one, do freelance or informal work, or be searching for work at the moment.

And even those who are employed do not necessarily have it visible on their employer's website; for instance, I don't think my current employer has any publicly available page listing all employees, and I never had (and don't have any desire for) a LinkedIn account.


For a state level attack, that wouldn't even help. They'd just use state level forged documents.


State actors (probably the case here) can handle all that stuff.


If an identity (known or pseudonymous) was signed by a government, there would at least be some accountability. Like if Jia Tan's identity is signed by government X, then there is a good hint that they are a state actor for X or otherwise there is a burden for X to come up with convincing evidence that this is not the case.

Obviously, every system is going to have weaknesses, but it would at least introduce some accountability.

The main issues are all related to privacy. What if your government is not nice and you don't want them to track all your contributions?


Let's say we would have definite proof that this was a Chinese op. Then what? No other government is gonna complain too hard because they know that their own agencies are doing the very same thing too.

Additionally, creating fake identities in other states is base level spying.


No other government is gonna complain

Maybe not. But to the open source community it does provide more information. Now it's completely unclear who compromised xz, if the account had a government-level signature of some sort, more is known. Also, the open source community could have different levels of trust in authors with different signing authorities [1].

Additionally, creating fake identities in other states is base level spying.

We are not talking about a fake identity here (as in a fake passport or whatever), but getting a signature from a device that is presumably in a facility that is disconnected from the network. The user's identities would also live on a hardware device (e.g. chip embedded in a passport/id).

You could steal the hardware device to steal someone's developer identity. But the identity can be revoked once the device is reported/stolen. So, it is hard to play the long game with a stolen identity, outside blackmailing or otherwise compelling a developer to make their identity available (but even in that case it'd give some leads in understanding who the actor is).

Apple Developer signing keys are similar. You can verify where an app comes from. If a developer goes rogue or their key is compromised, Apple can revoke it. Apple could do evil stuff by creating sock puppet accounts, but that would devalue the trust in their signing key.

---

[1] I should note that I am not in favor of this. It's a privacy nightmare and it would give governments a lot of control over developers. I just think the argument upthread that a state actor could fake anything is not true. If e.g. the US had such an identity signing system, a foreign power could not forge the identities as long as the US private key is not compromised.


https://www.linkedin.com/pub/dir/Jia/Tan

Take your pick! 1600+ to choose from.


some projects are asking for physical id and signing a contract since decades




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: