Securing Git repositories with gittuf [LWN.net]

Securing Git repositories with gittuf

Posted May 10, 2024 11:24 UTC (Fri) by weal (guest, #168153)
In reply to: Securing Git repositories with gittuf by LtWorf
Parent article: Securing Git repositories with gittuf

Just imagine being a beginner and trying to learn git with all this extra stuff on top. It reminds me of jobs where I have had to spend a week doing some esoteric configuration just to get setup to get started. You just know the project is going to be a frustrating experience.

This sounds like a typical "make work" project to keep us all busy. To make us into "experts" and "specialists" in this New Thing.

I can understand that in certain situations "compliance" (whatever that means) is worth it, and in those cases they can hire someone for that purpose and use tools that stay out of my way as a dev. The vast majority of projects will be harmed by tools like this for having "too many cooks in the kitchen".

to post comments

Securing Git repositories with gittuf

Posted May 10, 2024 13:29 UTC (Fri) by LtWorf (subscriber, #124958) [Link] (3 responses)

Well I think the entire point of OpenSSF is to shove compliance to some sort of rules down the throats of developers.

I've actually tried to implement their scorecard thing for my project "typedload".

For example, you need to pin dependencies, because a new version might introduce vulnerabilities… but you also need to update the pin all the time for old security vulnerabilities. Also, if you never read the code of the dependencies, what is the point of pinning to a specific version? Nobody has vetted it any more than a newer version (I always use latest mypy in the CI).

They want me to have a "dependency update tool"… the project only depends on python, and certainly doesn't vendor it.

Or they want me to have branch protection and code revisions. Cool… except who should review my code? Most other contributors just changed a few lines here and there. The suggestion to fix this is "find more people".

I work for a security company and we have fewer requirements than that :D

Anyway, this thing being sponsored by OpenSSF makes me think their goal is to enforce these rules onto open source, so that eventually proprietary stuff will only run the secure™ (is on github, runs their scorecard) open source software and will automatically be compliant without extra vetting of the dependencies.

The hilarious thing is that you can write an "rm -rf /" in your code and still be 100% compliant with everything. Because the idea that you can evaluate security of a project just basing on some abstract rules, without actually reading the code is wrong to begin with.

Securing Git repositories with gittuf

Posted May 10, 2024 16:12 UTC (Fri) by Wol (subscriber, #4433) [Link] (2 responses)

> Or they want me to have branch protection and code revisions. Cool… except who should review my code? Most other contributors just changed a few lines here and there. The suggestion to fix this is "find more people".

You mean people like Jia Tan ... <snigger>

Cheers,
Wol

Securing Git repositories with gittuf

Posted May 10, 2024 16:34 UTC (Fri) by mb (subscriber, #50428) [Link] (1 responses)

Yes. That is no contradiction.

No amount of code signing, authorization process, signing-offs and higher entry barriers are going to prevent another Jia Tan.
That is basically impossible to prevent.

However, more people and *lower* entry barriers significantly increase the chance of *detecting* another Jia Tan.
Scaring people away with useless processes is going to make us more vulnerable in the end.

Securing Git repositories with gittuf

Posted May 10, 2024 17:02 UTC (Fri) by LtWorf (subscriber, #124958) [Link]

Lower entry barriers might mean 100x more jia tan :D