Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xz: A microcosm of the interactions in open source projects

robmensching.com

Post reply on HN
Print view View original

121–130 of 353 posts

Re: Xz: A microcosm of the interactions in open source projects

#121

Post by cqqxo4zV46cp »

b112 wrote: post #38
orbital-decay wrote: post #30

Earlier quoted context omitted.

It's not like organizations writing proprietary software are magically immune to sleeper agents either. Social engineering is not a software or tech problem in general. Trust is required to get anything done, and can also be abused to hell and back by a sufficiently motivated actor. But important software needs to be identified and proportionally more scrutinized by multiple independent parties, that's the lesson. Id…

This is why OSS can be more secure. How much software has the build scripts, the code, all of it, locked away and hidden behind propriety software? Instead of lots of eyes, just 2 DEVs? Yes, this almost succeeded... but can you imagine how many scenarios where someone such as Andres Freund would have found irregularities, but then.. what? Just had to report it to some webpage's contact page? Without being able to eve…

It’s pretty intellectually dishonest to call this a big win for open source. It’s completely and utterly bonkers that this was noticed. Unthinkably low odds. There are certainly other backdoors out there like this, already in production.

If this happened on a proprietary software project, …I have verified proof of identity documents for everyone on my team. These can of course be faked or fraudulently obtained, but it heightens the barrier to entry and leaves more of a paper trail. That’s not something that we have in this scenario. There’s way more give and take between open and closed source than open source purists make out. They just like the idea of being able to see source code.

Re: Xz: A microcosm of the interactions in open source projects

#122

Post by lukan »

cqqxo4zV46cp wrote: post #113
lukan wrote: post #86

Earlier quoted context omitted.

I think the linux kernel developement is quite open. But Linus is famous for telling people directly in not so nice words, that they are not helping. I don't think insults are the solution, but giving a clear no, is a skill many people struggle with. And if some cannot cope with that, blocking individuals also works.

My understanding was that Linus is cooling his jets a bit?

Yes, he wants to stop using insults, which I think is good. But he still won't tolerate BS, or timewasting.

Re: Xz: A microcosm of the interactions in open source projects

#123

Post by keybored »

em-bee wrote: post #60
arp242 wrote: post #39

Earlier quoted context omitted.

In the end you're only pressured as much as you allow yourself to be pressured. "I don't feel like it, if it's important to you then feel free to fork". That's really all that's needed. "I don't feel like it" is all the justification you need. Some guy just made a compression tool, because some people like doing that kind of thing, or because it was useful for him. He didn't ask to be made "critical infrastructure" o…

"I don't feel like it, if it's important to you then feel free to fork". That's really all that's needed. that's much harder than it sounds. having someone fork your project can give you the feeling of loosing control over the project as potentially all your users might go with the fork. that fear is often strong enough to push yourself to do things that will avoid a fork. it's a desire for harmony and a fear of conf…

This fear doesn’t harmonize with the mantra about how no one owes anyone anything. If the code is OSS then you can’t lose control over the project since you have no inherent control over it to begin with.

Re: Xz: A microcosm of the interactions in open source projects

#124

Post by arp242 »

em-bee wrote: post #108
arp242 wrote: post #68

Earlier quoted context omitted.

You're right of course, but there are cultural norms and expectations at play here, which I feel need to be modified somewhat. And that doesn't really change that things really are that simple, kind of. How do you stop smoking? By not lighting up any cigarettes. Of course it's not that simple, but ... it also kind of is.

there are cultural norms and expectations at play here, which I feel need to be modified somewhat this is an important observation. a change of culture is really what is needed here, because it implies that not only maintainers change their behavior, but everyone involved, and the question is not so much what any individual can do for themselves, but how we can help others with that change and spread it

It's impossible for everyone to change their behaviour, because that's too many people. Some people are just assholes and don't care. Or they're idiots and don't understand. Nothing we can do about that. Most people are alright, but with 8 billion people on the planet even a small percentage being an asshole means a lot of assholes.

For the most part, the people who care already care (you, me, most others commenting here) are not really the problem.

So ultimately the only thing you can do as a maintainer is set your own boundaries for yourself. And the original message in that thread ("there is no activity, what are your plans?") is a fair question, although the follow-ups are not.

All of this is true for a lot of the internet by the way. The best thing of the internet is that anyone on the planet can talk to anyone else on the planet. When I was a kid I did some ham radio with scouting, and you could talk to people from places like Russia and the US. Wow!

The worst thing of the internet is that anyone on the planet can talk to anyone else on the planet. You're constantly exposed to a seemingly never-ending stream of assholes and idiots, and a single asshole can ruin the day of dozens, hundreds, or even thousands of people every day. Maybe this is just 1% of people, but 1% of 8 billion is 80 million.

Re: Xz: A microcosm of the interactions in open source projects

#125

Post by graemep »

tkiolp4 wrote: post #97

If I were a chinese hacker trying to do something evil, why on earth would I use a chinese handler/username? Wouldn’t it be better to use an English/European name to gain (even more) trust from open source maintainers? On the other hand, if I were a non-chinese hacker trying to do evil, then using a chinese handler does make more sense (China is evil, blah blah blah)

According to a comment on another thread it is not a mainland Chinese name, so that might still be chosen to mislead in a more subtle way. https://news.ycombinator.com/item?id=39869047

Western and Chinese are not the only possibilities, it could be a Russian, or Indian or pretty much anywhere else that engages in intelligence gathering operation.

Re: Xz: A microcosm of the interactions in open source projects

#126

Post by mikeocool »

stavros wrote: post #71
cassianoleal wrote: post #70

Earlier quoted context omitted.

> It made it to production, for a long time Did it? At least in Debian, where it was found in the first place, it only existed in sid/unstable and I think perhaps in testing. It never made it into stable which is the only thing you should be running on a production system. I think in Fedora it was also only in a testing or RC of the next stable version but I'm not sure. Also unsure about others. I have seen several d…

I don't know specifics either, but Debian stable has years-old packages, so I'm not sure if it's a good indicator of how widespread this got. If it's in the latest Ubuntu release, I'd say it's pretty successful.

Fortunately, it didn’t make it into an Ubuntu release: https://discourse.ubuntu.com/t/xz-liblzma-security-update/43...

Though it was frighteningly close, 24.04 is scheduled to be released on April 25.

Re: Xz: A microcosm of the interactions in open source projects

#127

Post by nindalf »

arp242 wrote: post #111
stavros wrote: post #77

Earlier quoted context omitted.

Well, when you say "the victim could just not have succumbed to the pressure" I don't see how that doesn't blame the victim. I understand it's not your intention, but peer pressure works exactly because it gets around people's "wait, I don't actually want to do this" defense, and to say "just don't do it, nobody is physically forcing you to" ignores that fact. If I were in the maintainer's shoes, and was feeling ambi…

Anything can be viewed as a judgement statement if you paraphrase or stretch things enough. I don't think your paraphrasings are a fair representation of what I actually said. But you can insert "I'm not trying to blame anyone, but here are some suggestions to modify cultural norms so these things are less likely to happen in the future" if you want. Or you can just assume good faith and take that as implied unless d…

> I don't think your paraphrasings are a fair representation of what I actually said.

I think their paraphrasing was a fair representation. You want to have it both ways. You said some incendiary victim-blaming thing, but now you're backpedaling with a "no no, you misunderstood".

Re: Xz: A microcosm of the interactions in open source projects

#128

Post by acdha »

wood_spirit wrote: post #89
SuperHeavy256 wrote: post #10

So the first step of this huge mess was: a social engineering attack. Attacking a tired, burnt-out open source project developer and peer pressuring him into giving more control of the repo to the attacker.

Occams razor says that those commentators were not in on it; that pressure is common on all projects, there is no need to think that they were part of an attack. In fact, Occam’s razor says that the malicious code was injected by a compromised account and not a malicious actor who spent years steadily getting into position to attack?

I don’t think that’s a good application of Occam. Does it really seem parsimonious to think that someone who shows up with no prior history or subsequent activity is really just a random open source user who cares deeply about new maintainers for a low-level library they’re otherwise silent about?

Re: Xz: A microcosm of the interactions in open source projects

#129

Post by graemep »

aumerle wrote: post #65
kimixa wrote: post #31

I do sometimes wonder if by trying to be "nice" to users and try to see the best intentions of commenters, many developers waste huge amounts of mental energy. For context, I've really only worked on "fun" side projects, namely emulators and game remakes, where I've explicitly avoided any mention of donations or similar. Both as it's intended to be a distraction from my job, not become part of it. And generally avoid…

You dont need to wonder. Any long term maintainer of even semi popular open source projects will tell you that engaging with the peanut gallery is completely counter productive. Engage with people that have earned it in your eyes, whether by contributing to your project via code, assets, bug triage, writing a good and effortful bug report, whatever. Just ignore what the larger internet has to say about you and your c…

I think this is a wider social problem of the internet.

Most people want to be helpful to others. This works fine when it is with a limited no of in real life interactions with mostly reasonable people. It can get wrecked by one or two unreasonable people, but the more fundamental problem is that it does not scale well, and the internet takes it to a far greater scale.

It is one reason so many of us essentially work for free for FB and the like: we do things to help others (advice and information), and the side effect is creating content and data for FB.

Re: Xz: A microcosm of the interactions in open source projects

#130

Post by stavros »

mikeocool wrote: post #126
stavros wrote: post #71

Earlier quoted context omitted.

I don't know specifics either, but Debian stable has years-old packages, so I'm not sure if it's a good indicator of how widespread this got. If it's in the latest Ubuntu release, I'd say it's pretty successful.

Fortunately, it didn’t make it into an Ubuntu release: https://discourse.ubuntu.com/t/xz-liblzma-security-update/43... Though it was frighteningly close, 24.04 is scheduled to be released on April 25.

Wow, ok, that's close. I wonder how many have actually made it.
Post reply on HN