Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xz: A microcosm of the interactions in open source projects

robmensching.com

Post reply on HN
Print view View original

141–150 of 353 posts

Re: Xz: A microcosm of the interactions in open source projects

#141

Post by someguydave »

dwb wrote: post #54

I'm under no illusions that this is a totally new thought, but for me first with cryptocurrencies, then "AI", and now this, the fundamental issue that the biggest problems come back to is one of trust. Cryptocurrencies try to code around it, LLM boosters try to dazzle you into it, and the attacker here half-succeeded in laundering it. The most consequential (rightly or wrongly) technologists of our time are failing t…

A few minutes reflection on “who can I trust” would lead one to discard the extremely egalitarian ethos built up around open source software. But casting out meritless ankle-biters will immediately lead to being attacked as an unreconstructed egotist who needs to be hung from the neareat Code Of Conduct

Re: Xz: A microcosm of the interactions in open source projects

#142

Post by qsi »

arp242 wrote: post #84
slavik81 wrote: post #32

I'm starting to feel that one of the lessons here is that individuals invited into trusted positions should be identifiable. Jia Tan is not a real person. We don't know who they are, so there is no way to hold them accountable.

While all of this is of course quite serious, we also need to remember that these types of things are actually fairly rare. Last major one was that JS event-stream thing, and that was in 2018 (5 and a half years ago). I don't think this is really a structural problem requiring these kind of sweeping changes; it's just an occasional rare incident.

As far as we know, they're rare...

Re: Xz: A microcosm of the interactions in open source projects

#143

Post by supriyo-biswas »

b112 wrote: post #38
orbital-decay wrote: post #30

Earlier quoted context omitted.

It's not like organizations writing proprietary software are magically immune to sleeper agents either. Social engineering is not a software or tech problem in general. Trust is required to get anything done, and can also be abused to hell and back by a sufficiently motivated actor. But important software needs to be identified and proportionally more scrutinized by multiple independent parties, that's the lesson. Id…

This is why OSS can be more secure. How much software has the build scripts, the code, all of it, locked away and hidden behind propriety software? Instead of lots of eyes, just 2 DEVs? Yes, this almost succeeded... but can you imagine how many scenarios where someone such as Andres Freund would have found irregularities, but then.. what? Just had to report it to some webpage's contact page? Without being able to eve…

> Yes, this almost succeeded... but can you imagine how many scenarios where someone such as Andres Freund would have found irregularities, but then.. what? Just had to report it to some webpage's contact page? Without being able to even dig further?

You should check the thread posted yesterday, the Lastpass guy who raised a PR for a go binding for xz but was otherwise unrelated to this fiasco already faced a bit of questioning regarding their motivations from their employer based on a user reporting them from a contact form.

Moreover, many companies already have information from background checks, and in certain countries, they also have the tax identification number of the employee which can pretty much identify who put in the backdoor.

Re: Xz: A microcosm of the interactions in open source projects

#144

Post by AtNightWeCode »

slavik81 wrote: post #32

I'm starting to feel that one of the lessons here is that individuals invited into trusted positions should be identifiable. Jia Tan is not a real person. We don't know who they are, so there is no way to hold them accountable.

Humans can always be compromised. This specific case can only be solved by improved tooling, workflows, visibility, runtime environments and so on.

Re: Xz: A microcosm of the interactions in open source projects

#145

Post by stavros »

keybored wrote: post #135
stavros wrote: post #58

Earlier quoted context omitted.

This ignores the very fact that peer pressure works and puts the entire blame on the victim. No, people react differently when pressured vs when not pressured. That's the entire reason why peer pressure works.

Peer pressure happens when someone like a teenager wants or has to be around some other peers (teenagers) but has to follow the whims of the peers in order to continue to be around them or to not be harassed by them. The peanut gallery of non-contributors are only peers in the sense that they pretend to speak on behalf of some OSS community. And the fact that they are spokespersons is by default suspect. The attacker…

Many maintainers want to please their users, and be helpful (which is admirable, and more power to them), which means #2 applies. Sure, the maintainer is entitled to say "fuck you, I want to sit on my project and you can fork it if you want", but he was, presumably, trying to be helpful and succumbed to pressure.

I don't think the maintainer is at fault to any degree here. Sure, this could have been avoided if the maintainer refused to be pressured and kept sitting on the project and letting it die, but it's not his fault that he didn't do that, and I wouldn't want that to be the default for maintainers either.

Re: Xz: A microcosm of the interactions in open source projects

#146

Post by tonnydourado »

arp242 wrote: post #39
SuperHeavy256 wrote: post #10

So the first step of this huge mess was: a social engineering attack. Attacking a tired, burnt-out open source project developer and peer pressuring him into giving more control of the repo to the attacker.

In the end you're only pressured as much as you allow yourself to be pressured. "I don't feel like it, if it's important to you then feel free to fork". That's really all that's needed. "I don't feel like it" is all the justification you need. Some guy just made a compression tool, because some people like doing that kind of thing, or because it was useful for him. He didn't ask to be made "critical infrastructure" o…

The maintainer did mention mental health issues. It can be hard to say no in the best of times, let alone when your own mind is trying to screw with you.

Re: Xz: A microcosm of the interactions in open source projects

#147

Post by supriyo-biswas »

secondcoming wrote: post #131
damagednoob wrote: post #105

Earlier quoted context omitted.

Something I've observed as an English speaking immigrant is that in general, the US/UK is very forgiving when it comes to foreigners trying to speak English. Where certain types of phrasing and harsh words would not be tolerated with first language English speakers, the benefit of the doubt is given to 2nd/3rd language speakers because they 1. Might not have the vocabulary to express themselves correctly 2. Not under…

The English used in the commit messages I’ve seen was pretty much perfect, but unfortunately the repo has been suspended now.

A mirror is here[1] for someone who wants to read the commit messages, though as I understand it is insufficient for reproducing the backdoor at compile time because it is missing the m4/ files required for this purpose.

If someone has the additional details to reproduce the backdoor, please let me know and I'll add these files in the repository.

[1] https://github.com/supriyo-biswas/xz-mirror

Re: Xz: A microcosm of the interactions in open source projects

#148

Post by polio »

kijin wrote: post #34
msk-lywenn wrote: post #21

Earlier quoted context omitted.

No. But if the maintainer is burning out and doesn't have free time available for it, paying them so they can take time off to actually work on the thing is a nice way of fixing issues.

Not everyone can take time off from their day job just because somebody paid them a nominal amount of money. Besides, the maintainer in this case was already taking time off regularly, not to work on xz, but to get away entirely from any kind of programming work. Throwing money in his general direction probably wouldn't have helped with the burnout, unless you were offering to help him hire somebody.

The more money we give, the more viable it becomes for maintenance to become their day job. It's very likely that more money here would've mitigated the burnout. Aside from just being able to quit their actual job and focus on their passion project, it's acknowledgement that the world finds this work valuable. In many cases, burnout comes from a lack of recognition, or the sense that you've done all this work and nobody really cares.

Re: Xz: A microcosm of the interactions in open source projects

#149

Post by dwb »

concordDance wrote: post #138
dwb wrote: post #54

I'm under no illusions that this is a totally new thought, but for me first with cryptocurrencies, then "AI", and now this, the fundamental issue that the biggest problems come back to is one of trust. Cryptocurrencies try to code around it, LLM boosters try to dazzle you into it, and the attacker here half-succeeded in laundering it. The most consequential (rightly or wrongly) technologists of our time are failing t…

> The most consequential (rightly or wrongly) technologists of our time are failing to properly think about trust. Because that's an insanely hard problem that's outside our area of expertise. Consider how much money governments spend on all the red tape they add to increase trust. If there was naturally perfect objective alignment and trust I bet any infrastructure project would cost about 10% of what it does.

It is hard, but I think corporate open source users and entrepreneurial software developers have a moral responsibility to do more than I see being done in the areas that I listed. To be crystal clear, in this case where I don't think Lasse is at all culpable, the responsibility would be with the companies that profit from the work done on xz-utils.
Post reply on HN