Re: Fwd: [siren] Severity: High – Potential Malicious Campaign Underway Targeting Open Source Developers via Slack

[Stuart D Gathman <stuart () gathman org>]

On Wed, 8 Apr 2026, Solar Designer wrote:

> Also seen at https://lists.openssf-vuln.org/g/siren/message/7

> Subject: [siren] Severity: High – Potential Malicious Campaign Underway Targeting Open Source Developers via Slack
> # Overview #
> The community has received reports of an active social engineering
> campaign targeting open source developers via Slack (including
> ToDoGroup and related communities).  In the reported incident, an
> attacker impersonated a well-known Linux Foundation community leader
> and attempted to lure the victim into following a malicious link:
etc

As listed in this and other recent OSS emails, platforms exploited included
Slack, Teams, Google, etc

The method is to create a convincing fake account on the centralized platform.

Is this a weakness that is aggravated by centralized platforms?

Federated protocols like SMTP, Matrix, XMPP, etc would require a
deceptive domain name (like the legendary lBM.com of Arial font fame)
for a similar attack.  (Fully decentralized protocols like SSB 
just have pubkeys - but I suppose users might get fooled by a new
pubkey with icons and earlier messages that look like a party
being impersonated.)

Is this evidence for a general recommendation against centralized
platforms for open source development?  More to the surprise of
my preconceived ideas - are fully decentralized protocols subject
to similar social engineering?  There is not much difference between
a Facebook internal account number and a pubkey for most end users.

The issue with federated protocols is that any trusted CA can forge
any TLS cert - a "serial reliability" problem.