The repository of the popular Syncthing fork for Android disappeared from GitHub and reappeared under dubious circumstances – is this an open-source hack?
  • Telex@sopuli.xyz
    2·
    3 hours ago

    Does some place have a trusted archived copy? Should be easy to checksum a given common commit in their history and read forward.

  • Emanuel [comrade/them]@hexbear.net
    3·
    17 hours ago

    Of note in this article is the mention of nel0x’s fork of Syncthing-Fork, which is, as much as I’ve gathered, and old contributor to Syncthing and more trusted member of the community than researchxxl, as well as much more transparent about the whole changing of hands of the Syncthing-Fork project.

    This issue on researchxxl’s fork might also be of interest, as it documents the (lack of) response to the whole sketchiness of what is happening, as well as more discussion.

    • CandleTiger@programming.dev
      16·
      22 hours ago

      I really don’t see why there are so many people around saying “it’s probably fine”

      In my personal opinion shit like this is probably not fine at all.

          • CandleTiger@programming.dev
            5·
            11 hours ago

            Yes. It’s very very hard to read the source and know there’s no security bug in it. That’s 10x truer when the security bugs are potentially on purpose, and carefully hidden.

      • sylver_dragon@lemmy.worldEnglish
        32·
        20 hours ago

        I really don’t see why there are so many people around saying “it’s probably fine”

        Because there is currently no direct evidence of anything amiss. From the linked article:

        Technically, the changes made so far have been reviewed by some people and no obvious malicious modifications have been found; F-Droid also builds the app reproducibly and verifies whether the published code matches the binaries

        Granted, someone could be playing a long game here. Get control, wait for the controversy to die down while playing nice, then do then rug pull when no one is watching anymore. That’s possible. It’s also quite possible that the previous maintainer got tired of doing a hard and thankless job for no pay and wanted to shed the whole thing. They found someone to hand it off to, and the new maintainer is just shit at open communications. That happens and is also possible. Whether or not it makes you change your usage of the package is down to your risk appetite. But, jumping at every shadow gets old quick and at some point you have to accept some risk. So, unless and until there is more evidence to backup the claim of foul play; or, if you have a really low risk appetite, this is one of those things which falls under “keep an ear open, but it’s probably fine”.

        • CandleTiger@programming.dev
          6·
          11 hours ago

          Because there is currently no direct evidence of anything amiss.

          You don’t need direct evidence of a problem. It’s the other way around — In order for the software to be trustable with private data you need steady, ongoing evidence that the authors are trustworthy.

          National spy agencies are out there, right now, and recently in the news, trying to suborn open source project maintainers. This is a known risk.