On 2021-01-25 18:33:36 +0100 (+0100), Christophe de Dinechin wrote: [...]
2/ PRs that take advantage of the testing infrastructure to execute malicious code disguised as unit tests. In a chat with Ariel, I described that as a "unit test" doing some bitcoin mining. This was the case I was more concerned with in the context of a discussion about merging test and code repos. Frankly, I'm surprised we don't get more spammers trying to do this kind of things, given that our testing infrastructure runs containers as well as unit tests that could do practically anything.
I suspect that what makes this hard today is the relatively low traffic in terms of number of PRs. We would notice bad PRs rapidly during review. [...]
Yes, I have a feeling the reason this sort of abuse isn't prevalent is that it's at least somewhat visible/discoverable, and attributable to an account which can be easily reported to the service's operators. As someone who also spends a lot of time running and maintaining a fairly large public code review and automated testing platform (one which allows anyone to propose changes with their own job configuration and runs builds from them before anyone even reviews the patches), I can say it's something we're always on the lookout for and prepared to lock down abusive IP netblocks if necessary to get things under control. As you pointed out, there's also plenty of lower-hanging fruit when what you want is raw processing power and you don't care how you get it. If you operate in network security circles at all you'll be painfully aware that at any point in time there are millions of compromised computers connected to the Internet and integrated into a slew of massive bot armies. But for bitcoin mining in particular these days, the more effective way to go about it is to just form a shell company in a part of the world where governments provide subsidized/free electricity to businesses and hook of giant farms of ASICs. At worst you may need to grease some palms so a few bureaucrats look the other way. -- Jeremy Stanley