The original maintainer came back recently and said that the handover has their blessing and the new maintainer is someone they know. Some people are still talking about moving to syncthing-tray, but it's still experimental on android.
While it's probably fine, it's also worth remembering the FBI's Operation Trojan Shield happened. Similar state sponsored APTs would be very happy to get into such a privileged position.
Yes. It’s very very hard to read the source and know there’s no security bug in it. That’s 10x truer when the security bugs are potentially on purpose, and carefully hidden.
I really don’t see why there are so many people around saying “it’s probably fine”
Because there is currently no direct evidence of anything amiss. From the linked article:
Technically, the changes made so far have been reviewed by some people and no obvious malicious modifications have been found; F-Droid also builds the app reproducibly and verifies whether the published code matches the binaries
Granted, someone could be playing a long game here. Get control, wait for the controversy to die down while playing nice, then do then rug pull when no one is watching anymore. That's possible. It's also quite possible that the previous maintainer got tired of doing a hard and thankless job for no pay and wanted to shed the whole thing. They found someone to hand it off to, and the new maintainer is just shit at open communications. That happens and is also possible. Whether or not it makes you change your usage of the package is down to your risk appetite. But, jumping at every shadow gets old quick and at some point you have to accept some risk. So, unless and until there is more evidence to backup the claim of foul play; or, if you have a really low risk appetite, this is one of those things which falls under "keep an ear open, but it's probably fine".
Because there is currently no direct evidence of anything amiss.
You don’t need direct evidence of a problem. It’s the other way around — In order for the software to be trustable with private data you need steady, ongoing evidence that the authors are trustworthy.
National spy agencies are out there, right now, and recently in the news, trying to suborn open source project maintainers. This is a known risk.
18 Comments
RustyNova@lemmy.world · 22 pts · 247d
Dammit. They are taking the last android syncthing client from us.
TwiddleTwaddle@lemmy.blahaj.zone · 14 pts · 247d
The original maintainer came back recently and said that the handover has their blessing and the new maintainer is someone they know. Some people are still talking about moving to syncthing-tray, but it's still experimental on android.
leobluefish@lemmy.world · 21 pts · 247d
That catfriend post was... a bit strange
QuestionMark@lemmy.world · 9 pts · 247d
They could have been hacked or forced.
RustyNova@lemmy.world · 4 pts · 247d
Where did you see that? Couldn't find anything on the repo.
Will still go with nel0x's version tho
trolske@feddit.org · 3 pts · 247d
It's on the forum, not on the GitHub
boredsquirrel@slrpnk.net · 3 pts · 247d
https://forum.syncthing.net/t/25661/165
boredsquirrel@slrpnk.net · -2 pts · 247d
sylver_dragon@lemmy.world · 18 pts · 247d
While it's probably fine, it's also worth remembering the FBI's Operation Trojan Shield happened. Similar state sponsored APTs would be very happy to get into such a privileged position.
CandleTiger@programming.dev · 20 pts · 247d
I really don’t see why there are so many people around saying “it’s probably fine”
In my personal opinion shit like this is probably not fine at all.
leobluefish@lemmy.world · 6 pts · 247d
For me that's an uninstall unfortunately and looking for another solution at the moment.
eldavi@lemmy.ml · -2 pts · 247d
is it because it's onerous to read the source?
CandleTiger@programming.dev · 7 pts · 246d
Yes. It’s very very hard to read the source and know there’s no security bug in it. That’s 10x truer when the security bugs are potentially on purpose, and carefully hidden.
eldavi@lemmy.ml · -1 pts · 246d
i would run a diff on the previous version compared to the current one.
sylver_dragon@lemmy.world · 5 pts · 247d
Because there is currently no direct evidence of anything amiss. From the linked article:
Granted, someone could be playing a long game here. Get control, wait for the controversy to die down while playing nice, then do then rug pull when no one is watching anymore. That's possible. It's also quite possible that the previous maintainer got tired of doing a hard and thankless job for no pay and wanted to shed the whole thing. They found someone to hand it off to, and the new maintainer is just shit at open communications. That happens and is also possible. Whether or not it makes you change your usage of the package is down to your risk appetite. But, jumping at every shadow gets old quick and at some point you have to accept some risk. So, unless and until there is more evidence to backup the claim of foul play; or, if you have a really low risk appetite, this is one of those things which falls under "keep an ear open, but it's probably fine".
CandleTiger@programming.dev · 11 pts · 246d
You don’t need direct evidence of a problem. It’s the other way around — In order for the software to be trustable with private data you need steady, ongoing evidence that the authors are trustworthy.
National spy agencies are out there, right now, and recently in the news, trying to suborn open source project maintainers. This is a known risk.
XTL@sopuli.xyz · 5 pts · 246d
Does some place have a trusted archived copy? Should be easy to checksum a given common commit in their history and read forward.
Lfrith@lemmy.ca · 3 pts · 246d
Marcus@scribe.disroot.org · 2 pts · 245d
There's a rough guide here: lemmy.zip/comment/23205163
Perhaps sufficient to get started...
Lfrith@lemmy.ca · 1 pts · 244d
t0fr@lemmy.ca · 2 pts · 245d
Yeah I really don't like this. Seems lik a terrible way to do this.
I've disabled updates on it.
I already no longer use it to sync my music (moved to Navidrome with Symfonium). Do I move away for my personal photos & documents?