From what I’ve read, thus-far, prohibiting autotools would be a good 1st-step.
Then auditing all the damn ocean-of-vulnerability-in-a-single-crufty-swamp dependencies, & getting committed about clarity & accountability in packages, would probably be required.
I read an article, a couple years ago, about web-frameworks…
The guy doing the writing said he found they were often malware, or corrupt, or trojans, or utter-bullshit…
Haskell’s got a kind of mantram: don’t bring in a whole framework, just compose what you need, yourself, together.
Its a granularity-difference.
Requiring a framework, which itself requires other frameworks, as that guy was pointing-out ( he wasn’t interested in Haskell ), is a liability nightmare.
But the culture of just having an infinite bring-in of frameworks & libraries, so one can write a little, easy code, is a culture that is biting the world’s security in the ass.
It cannot be, that people just include everything from everywhere, & somehow have secure/trustworthy systems.
To have a secure, trustworthy system, one needs to know that one has disincluded corruption/malicious-code.
That requires limiting what’s included, that includes auditing, that includes accountability, that includes having understandable, sufficiently-clear stuff that one is including.
Consistently, at all levels, relentlessly.
It’s a chain: you cannot have a weak-link without compromising the whole chain.
You cannot compromise ANY subsystem in a distro, & have a trustworthy distro.
There are 2 contradictory paradigms: the “magic bullet paradigm”, which doesn’t care how much rot, compromise, anything, so long as they include the “magic bullet” which takes-out the competitor…
… vs the “no weak-points, whatsoever, paradigm”, which doesn’t rely on magic, it relies on defense-in-depth, and carefulness, and everybody working coherently, etc, in order to disallow corruption/malicious-actors any leverage/grasp on us.
They are cultures, not just ideas.
Some people cannot tolerate a “no weak-points” culture, they “NEED” to compromise things ( I don’t care about the bugs, get more features in!!" ), and they must be put out into the other organizations/operations, because they CANNOT tolerate careful-paradigm.
It truly is a culture, or “religion”, and there’s no faking it.
Look to OpenBSD, & see what it takes to be like them…
I like the Go philosophy here: if you just need a function, copy the function, don’t import the whole module. A little code duplication is fine, and it significantly narrows your attack surface.
But while I agree with your point in general, you really missed the mark here. The problem with xz wasn’t pulling in sketchy dependencies, it was online bullying of a burned out FOSS dev. That’s not a technical problem, but a support one.
The solution to problems like the xz vulnerability must be about supporting FOSS devs. Review code, donate money, join mailing lists, etc. Be the support these devs need, and push back against outsiders who seem to be engaging in bullying.
From what I’ve read, thus-far, prohibiting autotools would be a good 1st-step.
Then auditing all the damn ocean-of-vulnerability-in-a-single-crufty-swamp dependencies, & getting committed about clarity & accountability in packages, would probably be required.
I read an article, a couple years ago, about web-frameworks…
The guy doing the writing said he found they were often malware, or corrupt, or trojans, or utter-bullshit…
Haskell’s got a kind of mantram: don’t bring in a whole framework, just compose what you need, yourself, together.
Its a granularity-difference.
Requiring a framework, which itself requires other frameworks, as that guy was pointing-out ( he wasn’t interested in Haskell ), is a liability nightmare.
But the culture of just having an infinite bring-in of frameworks & libraries, so one can write a little, easy code, is a culture that is biting the world’s security in the ass.
It cannot be, that people just include everything from everywhere, & somehow have secure/trustworthy systems.
To have a secure, trustworthy system, one needs to know that one has disincluded corruption/malicious-code.
That requires limiting what’s included, that includes auditing, that includes accountability, that includes having understandable, sufficiently-clear stuff that one is including.
Consistently, at all levels, relentlessly.
It’s a chain: you cannot have a weak-link without compromising the whole chain.
You cannot compromise ANY subsystem in a distro, & have a trustworthy distro.
There are 2 contradictory paradigms: the “magic bullet paradigm”, which doesn’t care how much rot, compromise, anything, so long as they include the “magic bullet” which takes-out the competitor…
… vs the “no weak-points, whatsoever, paradigm”, which doesn’t rely on magic, it relies on defense-in-depth, and carefulness, and everybody working coherently, etc, in order to disallow corruption/malicious-actors any leverage/grasp on us.
They are cultures, not just ideas.
Some people cannot tolerate a “no weak-points” culture, they “NEED” to compromise things ( I don’t care about the bugs, get more features in!!" ), and they must be put out into the other organizations/operations, because they CANNOT tolerate careful-paradigm.
It truly is a culture, or “religion”, and there’s no faking it.
Look to OpenBSD, & see what it takes to be like them…
I like the Go philosophy here: if you just need a function, copy the function, don’t import the whole module. A little code duplication is fine, and it significantly narrows your attack surface.
But while I agree with your point in general, you really missed the mark here. The problem with xz wasn’t pulling in sketchy dependencies, it was online bullying of a burned out FOSS dev. That’s not a technical problem, but a support one.
The solution to problems like the xz vulnerability must be about supporting FOSS devs. Review code, donate money, join mailing lists, etc. Be the support these devs need, and push back against outsiders who seem to be engaging in bullying.