Thread by @AlyssaM_InfoSec

I certainly believe while we have moved past the tip of the iceberg, we're nowhere done with #log4j and it's issues. EVERYONE is now looking at this package and finding new variants and even new vulns. Don't expect to sleep anytime soon my dear #infosec fam.

1/

That said, remember there are likely malicious actors out there looking for the next thing already. With log4j burnt and orgs rapidly applying mitigations and fixes, what next? Where do we find the next widely used package with significant vulnerabilities like this?

2/

With that in mind, please drop the adversarial bullshit. I've seen devs abdicating all responsibility for the maintainers. I've seen security folks hating on devs. The mistakes made that led to this vuln. are laughably easy (to us as #infosec professionals).

3/

However, how many of you pointing fingers are out there contributing? Are you helping maintainers understand their threat models and playing an active role in OSS yourself? No? Well perhaps there's an opportunity for you there? Oh it's not your job??

4/

The vast majority of OSS maintainers don't get paid for their efforts. The cooperative community effort is what is supposed to make OSS great.

But devs, don't you go feeling all vindicated either. The fact is these mistakes were basic AF. There's no excuse for that either.

5/

It's not like we haven't been aware of simple things like input validation for the better of two decades now. It's an active and lazy choice not to do it. And you don't get to hide behind this imaginary shield of OSS liability transfer either.

6/

And to the orgs that leverage OSS without contributing time and effort to assess libraries for vulnerabilities, you're at fault too. You profit off the community but then don't help secure the exact packages you leverage from it?? You've exacerbated this issue.

7/

So, TL/DR; We're a long way from the end of this mess. There will inevitably be more. So stop pointing fingers at each other and let's figure out how we work together to fix our crap.

/FIN