Slashdot Mirror
Linux Foundation's Census Project Ranks Open Source Software At Risk
jones_supa writes: The Core Infrastructure Initiative, a Linux Foundation effort assembled in the wake of the Heartbleed fiasco to provide development support for key Internet protocols, has opened the doors on its Census Project — an effort to figure out what software projects need support now, instead of waiting for them to break. Census assembles metrics about open source projects found in Debian's package list and on openhub.net, and then scores them based on the amount of risk each presents. Risk scores are an aggregate of multiple factors: how many people are known to have contributed to the project in the last 12 months, how many CVEs have been filed for it, how widely used it is, and how much exposure it has to the network. According to the current iteration of the survey, the programs most in need of attention are not previously cited infrastructure projects, but common core Linux system utilities that have network access and little development activity around them.
Are you honestly telling me that behemoth is somehow impervious to exploits and otherwise an upstanding model of open source programming?
I mean, I don't really care if it's there (sysvinit is) and has a risk factor of 0. I just find it odd that there's no mention of it at all.
That JavaScript interactive table thing is truly infuriating.
And do some actual work, like the rest of us.
The projects are not being paid enough attention because arrogant academic types are too busy telling us this kind of nonsensical information than actually doing something about it or considering ones own complicit nature in the issue with a concept known as "work avoidance via academia".
Frankly, even though the grant money is probably not all that much, I think they need to send some money LibreSSL's way and see what project comes up with the more robust, secure stack. OpenSSL is hampered by a lot of crufty, bad, and possible backdoored code and will be for quite awhile. Why companies are throwing support behind it rather than LibreSSL is beyond me.
As FOSS projects become more widely used (privately and by companies), it's an excellent idea to actually collect some statistics that give an idea of how well and how actively a project is maintained.
An attacker might e.g. get commit rights to several low-activity projects, insert malicious code, and wait for people to download updates and become easily exploitable.
No FOSS end-user ever checks code: they rely om the maintainers to produce clean and honest code. Large and tech-savvy businesses tend to be a little more cautious, but in the end only a minority have the staff and the budget to actually vet the code. So unless they're going to expose themselves by redistributing the code, or they know they're going to use it in mission-critical ways, they won't look into it very deeply.
This leaves users vulnerable. Because when a project is "asleep", it's a good candidate to slip in some backdoors.
Given the number of FOSS projects, it can be quite hard for any organisation to get an idea of (let alone metrics on) how well maintained those projects are. Doing this and making the numbers public is a very useful service.
Of course, as no doubt various FOSS enthusiasts will rush to point out, it's not a perfect indicator.
Well ... it isn't and it doesn't have to be, but it's a very useful indicator all the same. And if you can easily look up a project's rating, that will sharply increase the likelihood that it will be used.
I guess it's understandable. Those guys wrote those things to scratch an itch and they worked well enough long enough. If a company where trying to maintain all the code that goes into a typical Linux install for me, it'd probably cost billions of dollars. It seems to me it would be fairly easy to subvert entire subsystems in a distribution by, for example, waiting for everyone to be happy with how it works and going off, then picking up maintenance or starting a replacement project because "No one works on that old one anymore!" Next thing you know, the system you used to love is bleeding features left and right and before you know it ends up being a dumbed-down version of Windows. Maybe that's just the open source lifecycle on a scale of decades...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
There's far too much software out there that depends on having clocks close to in sync.
That is all.
No surprise about tcpd (aka Wietse Venema's TCP wrapper utilities) which has not been updated since its last release in 1997.
It should just be removed from all Linux distributions just as Arch did in 2011: https://www.archlinux.org/news...
Use something, anything else rather than this practically stone age software.
1. The .NET framework
Anyway, all the core programs will be eventually replaced by a systemd component.
So why bother maintaining the good old software?
I don't completely agree that project needs to be widely used to pose a high risk. There are certain applications which are not installed on many machines, but which security is extremely critical for the internet in whole. Two very good examples would be Quagga & BIRD. You can find one of them from very large number of core network deployments. They may not always be the ones that pass actual traffic, but they might be the ones that receive routing tables and pass them to other routers after modifying them as they allow you to modify them to fit your needs better.
Just for its lameness.
I am officially starting the Church Of SystemD, which will bring enlightenment to the masses.
Services praising The Holy SystemD will be performed at gunpoint, so stop making trouble with all those facts and shit and just get in line.
Just cruising through this digital world at 33 1/3 rpm...
Are they really at risk or just mature? after 20-30 years I don't see how tools like whois and bzip2 could really need that much development.
lose != loose
Why don't we try the open source route and have people adopt these at-risk core system utilities? Won't there be any interest if those are up for adoption? If we get 3-4 volunteers per tool we can for sure do something about this and get more people to contribute to those tools.
I would definitely be up for something like that.