Recent critical bugs found in the decentralized social media platform Mastodon, instigates an intriguing conversation around the inherent security risks within open-source software development. This type of software allows anyone to review, edit, or even exploit its code, as revealed when researchers from Cure53, funded by Mozilla Foundation, exposed the flaws.
Mastodon encounters high traffic, especially following the buyout of Twitter by Elon Musk, which attributed to its appeal for Mozilla. Operating as a federation, Mastodon comprises several thousand separate instances serving content, unlike centralized servers used by giants like Facebook or Twitter. Although details regarding these bugs were limited, one of the potential breaches, #TootRoot, could have given hackers root access to Mastodon instances, resulting in compromised accounts or phishing schemes.
It’s somewhat discomforting how long these critical issues lay dormant before Mozilla sponsored a security check out of its interest in using Mastodon. Even though none of the 14.5 million users appeared to be affected, it leaves room for speculation about a potential ill-intended actor exploiting these flaws.
This issue is not confined to Mastodon but can be seen across the world of free and open-source software, particularly in crypto. The security dynamics are up against an economic playfield where hackers might receive a bug bounty or sell the malicious information to the highest darknet bidder. And it’s a tall order expecting organizations with the stature of Mozilla readily investing resources in in-depth software audits.
The complexities are further fuelled by a vast sum of wealth flowing through applications. In fact, about $3.1 billion was stolen from decentralized finance protocols alone last year. Attempts to manage such issues produce solutions like “circuit breakers,” as suggested by the crypto user Diyahir Campos, pausing protocols to prevent abnormal withdrawals in the wake of a potential attack.
While such remedies are commendable, they do not entirely ward off crypto’s inherent security issues. Even the most secure organisations aren’t immune to fatal bugs, reminding us that there’s always a baseline risk attached to using any computer program. However, it does illustrate a sense of mutual responsibility and solidarity within the FOSS community, often valuing the respect earned from discovering and disclosing issues more than possible monetary gains. This gives a ray of hope to crypto – dependent on the collaboration of strong institutions, like Mozilla, to improve security. All this adds to what makes the world of open source software and cryptocurrency an ever-evolving, fascinating landscape.
Source: Coindesk
