• stevedidwhat_infosec@infosec.pub
      link
      fedilink
      arrow-up
      2
      ·
      4 months ago

      … he made plenty off the product and made additional when he sold. Devs ability to make money has nothing to do with companies coming in and injecting malware to the service.

      Any threat actor group with sufficient funds from various campaigns, spyware, etc could use said funds to buy out a dev, owner, etc.

      Not to mention state-sponsored threat actors. This is the perfect example of distracting from the fact of what happened.

      • onlinepersona@programming.dev
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        3
        ·
        4 months ago

        You don’t believe that income (or lack thereof) can motivate the sale of a popular library to a shady party?

        Any threat actor group with sufficient funds from various campaigns, spyware, etc could use said funds to buy out a dev, owner, etc.

        I don’t see VLC being bought out.

        This is the perfect example of distracting from the fact of what happened.

        If you say so… this isn’t the first time an underpaid opensource dev sold their project only for it to end up being used for ads or malware.

        Anti Commercial-AI license

        • stevedidwhat_infosec@infosec.pub
          link
          fedilink
          arrow-up
          2
          ·
          edit-2
          4 months ago

          Not at all what I meant. The premise was that this wouldn’t happen if they were being paid fairly. Supply chain attacks happen with or without fair pay.

          Look at what happened with the XZ backdoor. Whether or not they’re getting paid just means a different door is opened.

          The root of the problem is that we blindly trust anyone based on name-brand and popularity. That has never in the existence of technology been a reliable nor an effective means of authentication.

          If it’s not outright buying out companies it will be vulnerabilities/lack of appropriate management, if it’s not vulns it’ll be insider threat.

          These are problems we’ve known about for at least a decade+ and we’ve done fuck all to address the root of the problem.

          Never trust, always verify. Simple as that.