Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Define new release workflow #11

Open
goldfishlaser opened this issue Aug 29, 2024 · 23 comments
Open

Define new release workflow #11

goldfishlaser opened this issue Aug 29, 2024 · 23 comments

Comments

@goldfishlaser
Copy link
Member

goldfishlaser commented Aug 29, 2024 •
edited
Loading

Previously, I had the practice of continuously including my STL files during development. STL files are a type of compiler output and therefore have unreadable diffs that make them poorly suited for version control. Plus, it hasn't been a great way to manage the files. Already we had an issue where I changed some stl name or something and it broke a link.

I received advice to add STLs only during a release. So I would like to build a release. @maltfield How shall we go about it?
@goldfishlaser

This comment was marked as resolved.

Sign in to view
This was referenced Aug 29, 2024
Closed
Closed
Closed
Closed
@VanDavv

This comment was marked as outdated.

Sign in to view
This was referenced Aug 29, 2024
Closed
Open
Closed
Open
@goldfishlaser

This comment was marked as outdated.

Sign in to view
@maltfield
Copy link
Member

maltfield commented Aug 29, 2024 •
edited
Loading

Previously, I had the practice of continuously including my STL files during development. STL files are a type of compiler output and therefore have unreadable diffs that make them poorly suited for version control. Plus, it hasn't been a great way to manage the files. Already we had an issue where I changed some stl name or something and it broke a link.

I received advice to add STLs only during a release. So I would like to build a release. @maltfield How shall we go about it?

@goldfishlaser my concern about STL files isn't just that they're annoying, but that they could be malicious

As shown in the link above, STL files have been found in at least 1 case to be able to trigger a heap buffer overflow.

We need to find a way to mitigate this risk. Including potentially-malicious files in releases (as opposed to the sources) doesn't mitigate this risk at all.

I changed some stl name or something and it broke a link.

Unrelated, but this is solved by linking to the file at a specific commit, as opposed to the file at HEAD.

@maltfield
Copy link
Member

@VanDavv I'd be very curious to read some write-up about how it infected GitHub issues...

@VanDavv
Copy link

VanDavv commented Aug 29, 2024

I'd be curious as well, I tracked down the latest activity feed for this account and went onward to warm people around about this, as well as reported to GitHub as urgent.
I think GitHub took an action already as comment in my issue as well as other comments of this guy are already gone.
Must admit, it's first time I saw something like this...

Best of luck! ❤️

@goldfishlaser
Copy link
Member Author

goldfishlaser commented Aug 29, 2024 •
edited
Loading

@maltfield so you are worried that an attacker potentially compromises my OpenSCAD program so that when I create an STL it has malicious code in it? Or some sort of interloper in the middle swapping out my stl with a malicious one?

Because your example involves someone doing this on purpose.

@maltfield
Copy link
Member

maltfield commented Aug 29, 2024 •
edited
Loading

@maltfield so you are worried that an attacker potentially compromises my OpenSCAD program so that when I create an STL it has malicious code in it? Or some sort of interloper in the middle swapping out my stl with a malicious one?

Because your example involves someone doing this on purpose.

Yes, I am worried about your own devices being infected such that it is exploited by an attacker to inject malicious files into the BusKill repo in order to infect BusKill users.

@goldfishlaser
Copy link
Member Author

goldfishlaser commented Aug 29, 2024 •
edited
Loading

What do you have in place to sanitize image files?

@maltfield
Copy link
Member

maltfield commented Aug 29, 2024 •
edited
Loading

What do you have in place to sanitize image files?

I use qvm-convert in Qubes, and I recommend Dangerzone for most other people. Please see the other ticket for the feature request that I opened with Dangerzone to add STL file support.

Please read the other ticket about methods to mitigate potentially malicious STL files. I mentioned this in the OP as potential solution number 2.

@goldfishlaser
Copy link
Member Author

goldfishlaser commented Aug 29, 2024 via email

@goldfishlaser
Copy link
Member Author

goldfishlaser commented Aug 29, 2024 via email

@maltfield
Copy link
Member

maltfield commented Aug 29, 2024 •
edited
Loading

You're effectively blocking me from contributing to this project out of
fear that I have some sort of OpenSCAD zero day lol.

The risk isn't just OpenSCAD. It's your whole endpoint. I'm afraid you're not grasping the surface area of risk. I am especially concerned because you just came back from DEF CON.

Please read-through some of these historic examples of supply chain compromise that have affected other open source projects in the past decade +.

The users of BusKill are especially vulnerable people who have very powerful adversaries. I take the risk of supply chain vulnerabilities very seriously.

Fortunately, OpenSCAD files are not a risk (because it's feasible for a human to read their diff). I don't see how this blocks you from being able to contribute to BusKill.

@goldfishlaser
Copy link
Member Author

goldfishlaser commented Aug 29, 2024 via email

@maltfield
Copy link
Member

maltfield commented Aug 29, 2024 •
edited
Loading

STL files are not really a risk either.

Doubling-down on ignoring risk when I've pointed-out a 8.8/10 severity CVE that caused heap buffer overflows in 2022 does little to inspire confidence :(

@goldfishlaser
Copy link
Member Author

goldfishlaser commented Aug 29, 2024 via email •
edited
Loading

@maltfield
Copy link
Member

@goldfishlaser are your STL files reproducible?

@goldfishlaser
Copy link
Member Author

goldfishlaser commented Aug 30, 2024 via email

@maltfield
Copy link
Member

maltfield commented Aug 30, 2024 •
edited
Loading

This seems to refer to a system not to a particular file or file type

@goldfishlaser please generate your STL file on two distinct computers. Generate a sha256sum hash of the STL files generated on the two distinct computers, and add the sha256 hash values (output of sha256sum) to this ticket.

@maltfield
Copy link
Member

maltfield commented Sep 10, 2024 •
edited
Loading

@goldfishlaser were you able to test to see if your .stl files are reproducible?

If they are deterministic, then we can distrust the infrastructure and create a safe process to add them to the releases.

@goldfishlaser
Copy link
Member Author

I don't have access to one, let alone two computers set up with openscad at the moment.

Expected resolution time unknown.

@maltfield
Copy link
Member

@goldfishlaser Can you please share the instructions/steps for generating an STL file?

I also only have one machine, but I run VMs on it, so can test reproducibility for you.

@goldfishlaser
Copy link
Member Author

goldfishlaser commented Sep 11, 2024 via email •
edited
Loading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@goldfishlaser @maltfield @VanDavv and others