<![CDATA["Assume OSS is compromised" - that is a very very deep hole indeed]]>"Assume OSS is compromised" - that is a very very deep hole indeed

https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/defenders-guide-to-frontier-ai-checklist-for-cisos

]]>https://board.circlewithadot.net/topic/b4627e0b-0dfe-48b7-8aec-f9522d9aa010/assume-oss-is-compromised-that-is-a-very-very-deep-hole-indeedRSS for NodeFri, 15 May 2026 03:42:59 GMTFri, 24 Apr 2026 19:03:42 GMT60<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 20:45:19 GMT]]>@darkuncle @paul_ipv6 @jerry I'm pretty sure that's what the rocketbois have in mind.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Sempf/statuses/116461634793923510https://board.circlewithadot.net/post/https://infosec.exchange/users/Sempf/statuses/116461634793923510Fri, 24 Apr 2026 20:45:19 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 20:03:42 GMT]]>@paul_ipv6 @jerry @Sempf precisely

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/darkuncle/statuses/116461471149651793https://board.circlewithadot.net/post/https://infosec.exchange/users/darkuncle/statuses/116461471149651793Fri, 24 Apr 2026 20:03:42 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 20:00:48 GMT]]>@darkuncle @jerry @Sempf

"I say we take off and nuke the entire site from orbit. It's the only way to be sure."

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/paul_ipv6/statuses/116461459765254731https://board.circlewithadot.net/post/https://infosec.exchange/users/paul_ipv6/statuses/116461459765254731Fri, 24 Apr 2026 20:00:48 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 20:00:36 GMT]]>@jerry I should be in marketing. "In this new world of frontier AI, <copy and paste the same generic security advice that's been given for decades like zero-trust and inventory your assets>"

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Lee_Holmes/statuses/116461458950582403https://board.circlewithadot.net/post/https://infosec.exchange/users/Lee_Holmes/statuses/116461458950582403Fri, 24 Apr 2026 20:00:36 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:58:33 GMT]]>@jerry @Sempf given how much commercial software (from Palo Alto and Microsoft, among others) depends on OSS somewhere in the dev toolchain, assume *all software* is compromised

it's the only way to be sure.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/darkuncle/statuses/116461450905175923https://board.circlewithadot.net/post/https://infosec.exchange/users/darkuncle/statuses/116461450905175923Fri, 24 Apr 2026 19:58:33 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:57:19 GMT]]>@jerry "See, if you can read the source code, you should just assume it's compromised, but if you _can't_ read the source code, that's how you know it's good." 🤪🤡

]]>https://board.circlewithadot.net/post/https://beige.party/users/sundew/statuses/116461446046920071https://board.circlewithadot.net/post/https://beige.party/users/sundew/statuses/116461446046920071Fri, 24 Apr 2026 19:57:19 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:35:36 GMT]]>@jerry Let’s see how long anything lasts after ripping out curl, ffmpeg, etc b/c it _might_ be an attack surface.

]]>https://board.circlewithadot.net/post/https://ioc.exchange/users/hamishthepiper/statuses/116461360648935601https://board.circlewithadot.net/post/https://ioc.exchange/users/hamishthepiper/statuses/116461360648935601Fri, 24 Apr 2026 19:35:36 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:34:54 GMT]]>@jerry @Sempf

I'm going to be moving forward with my very own bespoke vibecoded OS. No way the hackers can plant anything in it if even I have no clue what's in there!

]]>https://board.circlewithadot.net/post/https://infosec.space/users/fennix/statuses/116461357940291022https://board.circlewithadot.net/post/https://infosec.space/users/fennix/statuses/116461357940291022Fri, 24 Apr 2026 19:34:54 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:28:53 GMT]]>@Sempf it's the only choice

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/jerry/statuses/116461334250518278https://board.circlewithadot.net/post/https://infosec.exchange/users/jerry/statuses/116461334250518278Fri, 24 Apr 2026 19:28:53 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:28:21 GMT]]>@jerry Whelp. Everyone convert those Linux AWS containers to Windows.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Sempf/statuses/116461332164464962https://board.circlewithadot.net/post/https://infosec.exchange/users/Sempf/statuses/116461332164464962Fri, 24 Apr 2026 19:28:21 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:11:55 GMT]]>@exception @jerry only way to be secure is to code it yourself using punch cards. Make sure to punch the holes yourself using a lot of force. Don't want a hanging chad to introduce a hidden vulnerability!

]]>https://board.circlewithadot.net/post/https://defcon.social/users/varx/statuses/116461267579928470https://board.circlewithadot.net/post/https://defcon.social/users/varx/statuses/116461267579928470Fri, 24 Apr 2026 19:11:55 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:11:02 GMT]]>@jerry it's not entirely out of line to simply "assume compromise" for any software (or the hardware it controls, Palo Alto) but it is indeed a deep hole. AI tools may actually make problems in open source "shallow" in ways not visible or verifiable in closed systems - and while the open source projects may not be able to buy expensive tooling people looking for things to brag about may spend their own money on those tools anyway.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/fencepost/statuses/116461264047860612https://board.circlewithadot.net/post/https://infosec.exchange/users/fencepost/statuses/116461264047860612Fri, 24 Apr 2026 19:11:02 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:10:06 GMT]]>@jerry OSS can be audited. I think that scares these companies most of all.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Epic_Null/statuses/116461260411709868https://board.circlewithadot.net/post/https://infosec.exchange/users/Epic_Null/statuses/116461260411709868Fri, 24 Apr 2026 19:10:06 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:07:10 GMT]]>@jerry Assume you will never now just how deeply all closed source software is compromised.

]]>https://board.circlewithadot.net/post/https://mastodon.savvy.ch/users/exception/statuses/116461248854449521https://board.circlewithadot.net/post/https://mastodon.savvy.ch/users/exception/statuses/116461248854449521Fri, 24 Apr 2026 19:07:10 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:04:51 GMT]]>@krypt3ia I guess we knew about them already

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/jerry/statuses/116461239771175164https://board.circlewithadot.net/post/https://infosec.exchange/users/jerry/statuses/116461239771175164Fri, 24 Apr 2026 19:04:51 GMT<![CDATA[Reply to "Assume OSS is compromised" - that is a very very deep hole indeed on Fri, 24 Apr 2026 19:04:23 GMT]]>@jerry NOT THE OFFICE OF STRATEGIC SERVICES!

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/krypt3ia/statuses/116461237939334442https://board.circlewithadot.net/post/https://infosec.exchange/users/krypt3ia/statuses/116461237939334442Fri, 24 Apr 2026 19:04:23 GMT