This morning, the creator of go-bindata deleted their GitHub account and someone else created a new account under the same name. When open source is at center stage for new innovations, the provenance and security of components is critical to the well-being of development practices in all industries.
As we saw with the removal of leftpad in #npmgate a few years back,
even small components can have an enormous reach across an ecosystem.
When developers chose to publish their work, they are taking on an
extraordinary responsibility...often unwittingly. They need to
consider this when choosing how to secure their credentials and how to
protect namespaces like GitHub ids because it’s not just themselves
they put at risk, the risk includes the entire ecosystem should they
be compromised.
This distributed risk is not unlike vaccines. Getting the flu might be
only a bother for you, but in reality, the life saved might be that of
your grandmother who doesn’t contract the virus on the holidays
because you were yourself vaccinated and unaffected.
A hijack of a known GitHub ID as in this latest disclosure could lead
to fake versions of popular components being published to the
repository for everyone to consume. The new reality is that developers
themselves are on the frontlines of modern security attacks. Their
ids, if compromised or hijacked could be unwittingly injecting malware
into an otherwise approved and sanctioned release of their components.
Response across the industry has been multifaceted with some users planning to use local cached versions of go-bindata, others questioning the trust of any open source components, and some attempting to track the provenance of components in GitHub:
The Central Repository has long required detached pgp signatures
produced with published keys for any components pushed to the
repository. This provides a permanent and audit-able secondary
authentication mechanism that consumers can use to validate who
created a component, and to validate the authenticity of a component
itself. This is an under utilized capability of the repository as most
consumers don’t bother to validate, however it stands apart in the
various component repositories that don’t even provide similar
protections.
We will continue to track this issue at Sonatype and provide updates as they are available.
.jpg)