News: 0000838965

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

GitHub's report on open-source security

([Security] Dec 4, 2020 15:40 UTC (Fri) (corbet))


GitHub has released its [1]"2020 State of the Octoverse" report ; one piece of that is [2]a report on security [PDF] . There are a number of interesting conclusions there, including that a surprising number of security vulnerabilities are planted deliberately. " Analysis on a random sample of 521 advisories from across our six ecosystems finds that 17% of the advisories are related to explicitly malicious behavior such as backdoor attempts. Of those 17%, the vast majority come from the npm ecosystem. While 17% of malicious attacks will steal the spotlight in security circles, vulnerabilities introduced by mistake can be just as disruptive and are much more likely to impact popular projects. Out of all the alerts GitHub sent developers notifying them of vulnerabilities in their dependencies, only 0.2% were related to explicitly malicious activity. That is, most vulnerabilities were simply those caused by mistakes. "



[1] https://octoverse.github.com/

[2] https://octoverse.github.com/static/2020-security-report.pdf

[I plan] to see, hear, touch, and destroy everything in my path,
including beets, rutabagas, and most random vegetables, but excluding yams,
as I am absolutely terrified of yams...
Actually, I think my fear of yams began in my early youth, when many
of my young comrades pelted me with same for singing songs of far-off lands
and deep blue seas in a language closely resembling that of the common sow.
My psychosis was further impressed into my soul as I reached adolescence,
when, while skipping through a field of yams, light-heartedly tossing flowers
into the stratosphere, a great yam-picking machine tore through the fields,
pursuing me to the edge of the great plantation, where I escaped by diving
into a great ditch filled with a mixture of water and pig manure, which may
explain my tendency to scream, "Here come the Martians! Hide the eggs!" every
time I have pork. But I digress. The fact remains that I cannot rationally
deal with yams, and pigs are terrible conversationalists.