Why does GitHub Security Lab do research like Man Yue Mo’s recent work on bypassing MTE on the Pixel 8? This question was asked on Hacker News and we think it’s worth a short thread. news.ycombinator.com/item?id=3975...
Post
First an important point: we only research open source code, which means that many parts of your phone (for example most of your apps) are out-of-scope for us. That said, all open source code is in-scope, including projects that aren’t hosted on GitHub.
0 reposts0 likes
In this particular case, Man Yue Mo found a bug in Arm Mali, which is an open source GPU driver used on many Android phones. Android itself is open source. developer.arm.com/downloads/-/...
Open source software is the foundation of much of the world’s software. So when open source wins, we win. And that’s why @github.com takes its responsibility seriously, to help make open source software more secure.
First, we run the GitHub Advisory Database, which is a comprehensive database of open source vulnerabilities. github.com/advisories