CrowdSec源代码泄露暴露可靠性与安全性问题
问题概述
近期CrowdSec的源代码泄露引发了对其社区支持、供应链安全以及API密钥管理的担忧。用户普遍反映在使用旧版Debian包时缺失社区防址列表、以及因高误报率而放弃产品，进一步加剧了对平台可靠性的质疑。
痛点标签
- 社区防址列表在旧版Debian包中不可用，迫使用户自行构建
- 高误报率导致产品不可用，最终被关闭
- 安全泄露导致API密钥被盗，影响代码完整性
- 依赖私有SaaS平台，缺乏可信的中立聚合者
- 对API密钥管理和供应链安全的担忧
待验证问题
- 社区版防址列表在旧版 Debian 包中是否仍然可用？
- 产品团队是否有改进 API 密钥管理和供应链安全的计划？
- 针对高误报率，是否有已公布的改进路线图？
证据
原话 · @Anonymous
Funny to see this after I spent the morning troubleshooting and fixing my crowdsec install on my debian 13 vps. Apparently they stopped supplying a community blocklist to my machine because I'm running the old debian packaged version instead of directly from them (http 500). I had a LLM build a blocklist from publicly available sources rather than tie myself more tightly to their SaaS platform.
原话 · @Anonymous
the Tanstack compromise is very likely to have been the leak vector ... appears to have been backdoored to extract an API key with authorization to read the private codebase.
原话 · @Anonymous
We implemented CrowdSec for bot/scraping mitigation. The architecture is sound, but it ended up having an unacceptable false positive rate for us. ... After a couple of months of work getting it ready to go I had to turn it off after a couple of days.
免责声明：本卡片由 AI 从社区讨论中提炼，属于「痛点证据」，是需求分析与验证的起点，不等同于「已验证的市场需求」。AI 存在分析局限，关键决策前请打开上方原始讨论人工复核。