@nobody lol, it would be hilarious, but perhaps not best to torture the english learners :)

So this should be interesting!

arstechnica.com/gadgets/2021/04/…

supply chain attacks are going to be a pain in the butt

just think what will happen when a common tool in a linux repository gets compromised

I'm wondering whether supply chain attacks were always this common and we just didn't notice, or have they suddenly started happening alot more often?

how likely is it that, sooner or later, a package like Firefox or Libre Office or Openssl is compromised and downloaded by millions of users from the official repos? After all, all it takes it a small common library or tool, installed by default

$ man yes

yes - output a string repeatedly until killed

OS's are full of those little programs, libraries, etc. The attack surface is enormous

@reed How do you know they aren't already compromised?

@nobody for something like Firefox etc. a backdoor wouldn't last too long, I suppose, because there are too many "eyeballs", researchers, hopefully better practices, etc. Sure, it might be compromised right now, but I'd expect to find it in the news in a few months if it was so

on the other hand, minor packages are more of a problem, so it might well be that some have been compromised for years and nobody has noticed yet

I imagine it wouldn't be hard for government hacking groups to spot all the "poorly maintained" packages in Debian/Fedora, and start collaborating, even taking over the projects and become the new maintainers over time, because the original devs aren't interested in supporting their software anymore

so one day you might find that John Doe, the new maintainer of that cool little package installed in lots of distros, is actually part of an APT group sponsored by some government

this world is becoming way too complex, and stuff can be trusted less and less. We are all going to die in a cyberpunk dystopia, I say

@reed May I ask why you didn't post your question about hashes to crypto.se?

@reed Its kinda already one

I mean, amazon wants to use AI to optimise workloads for employee muscle fatigue....

@nobody because I don't know enough about crypto, so I'm sure I wouldn't be able to write a question suitable for that community (or receive an answer I can understand), while here I guess it's easier

in fact, the answer I just got mentions the concept I was forgetting: length extension attack

I remembered reading something about insecure hashes when the input is added to a common prefix

@reed I'm not sure if the length extension attack applies here though

You see when a message is hashed, it is first padded. So H(m) is basically H(m||p).

So when you apply length extension, you get that padding in between the real message and the extension

Which makes me think length extension might not work here. But there may be a way around this. I don't know enough about crypto to say anything definitely.

@nobody, yeah, I thought about that. The "length" problem might apply above "block sizes" or multiples of that, or whatever that is (as I said, I don't know enough about crypto).

I haven't read the answer thoroughly yet

@reed Almost no one at sec.se knows enough about crypto.

in any case, the key concept here is "length extension attack", so knowing that I believe it's possible to look up more info (also on Crypto.SE)