Open-source software allows for collaboration across developers, but when not sufficiently maintained, problems can quickly travel down dependencies and cause catastrophe. I've personally used Free and open-source software (FOSS) since a little bit of time after I first started using computer and I've used FOSS from media players to photo editors to entire operating Systems (Ubuntu). But I was never any sort of a fanboy of them and I still thought of the commercial software in superior light. To me FOSS was at the time was for those who don't use the full set of features of paid software and for smaller scale software like media players.
Blockchain changed all that with it's incentive systems. Smaller scale software is never really something you depend a lot on.They can also be improved with much ease without a lot of technical expertise. But when it comes to security non-blockchain FOSS are at a huge disadvantage.
Inlate October, an issue was opened on an extremely popular node.js tool, nodemon, describing a deprecation warning that was being logged to the console.
Warnings like these aren’t uncommon. This one seemed harmless. It wasn’t even related to the nodemon project, but rather to one of its dependencies. This easily could have gone completely ignored because, in many cases, warnings like these often resolve themselves.
About three weeks after the initial report, Ayrton Sparling experienced the log output himself and found that a new dependency several layers deep was the cause of the warning. The output was coming from a strange bit of code at the end of a minified JavaScript file that did not exist in an earlier version and had been removed in a later version (compare [email protected], [email protected], and [email protected]). Ayrton’s research led him to a popular npm library, event-stream, which is downloaded nearly two milliontimes a week and, up until recently, was maintained by a reputable open-source developer.
Several months ago, control of event-stream changed hands, legitimately, to a relatively unknown user who asked for publishing rights over email. This user then updated event-stream to include the exploited flatmap-stream dependency in a patch version and then bumped the major version of event-stream without the dependency to limit the visibility of the change. New users who, presumably, are a little more inclined to question dependencies would get the latest version (4.x as of this writing) and users who depend on the previous version would automatically update to the infected patch release whenever npm install runs again (with many common configurations).
The article has lots of codes explained too. After some technical detils it explains soething that is extremly obvious to the cryptosphere: "So much software is built on the backs of people who are expected to work for free.
Let’s count all the things that went wrong.
- An application (Copay) was built by consuming dependencies over the network without the entire tree’s dependencies locked.
- Even without locked versions, those dependencies aren’t cached and are pulled on every build.
- Thousands of other projects are dependent on event-stream with the same or similar configurations.
- The maintainer stopped caring about a library that thousands of projects depended on.
- Thousands of projects consume this library for free and expect it to be maintained without any compensation.
- The maintainer gave full control to an unknown entity just because they asked for it.
- There was no notification that control had changed, thousands of projects were just expected to consume the package with no warning.
- There’s really no end—this list of things that went wrong could go on and on…"
That is the conclusion of the author. The solution is simple. Expand what we already have with cryptocurrency development into the entire FOSS ecosystem. That's the only fix we can have. Incentives are the easiest fix of them all if you can manage to set it up well.
