Trust in FOSS Ecosystem: Maintaining What’s Harder To Build

Thanks to maintainers and supporters, FOSS grows in prominence year by year. But that comes with a reality that FOSS becomes a lucrative attack target. Trust is a shared binding thread across FOSS projects. This trust placed by users is the new attack surface.

I’ll give a brief overlook on three recent attacks that targeted different points in the trust model. XZ-Utils attack, Shai Hulud and recent AUR attack, while all being different in mechanism, share a common fact that it wasn’t a technical bug; rather a point in the trust model was exploited. Through these examples, I’ll put forth the need for a stronger footing behind trust in FOSS projects. Despite the attacks that have happened in recent past and vulnerabilities discovered in open source projects, the fact remains that FOSS is the only model that can win trust. Proprietary software simply cannot prove why they should be trusted.

Yet the fact remains that one cannot fully trust software unless one can trust every component right from the hardware to the execution environment. Ken Thompson interestingly mentioned how it is more important to trust the people writing that code. In the present FOSS ecosystem, it makes an important point about why FOSS projects & maintainers deserve better funding, support and contributions to sustain their projects in a healthy manner.

• The main intent is to make attendees, especially beginner engineers more aware about why source code is not the only place where vulnerabilities can exist.

• Understand the transitive flow of trust in software. Supply chain isn’t just a stepwise flow of software, but also trust.

• Acknowledge the significance of recent attacks and why not just big comparies, but even common individuals are also an attack target

• Briefly know about new methods to establish trust - reproducible builds, Sigstore, Rekor, public build logs

• Most importantly, appreciate what Ken Thompson said:
  > it is more important to trust the people who wrote the software