The xz backdoor thing reminds me of a story
rigor-mortis.nmrc.org
The xz backdoor thing reminds me of a story
1–10 of 99 posts
Re: The xz backdoor thing reminds me of a story
#2[flagged]
Re: The xz backdoor thing reminds me of a story
#3I don't doubt that this happened, but if you use e-verify and fill in Form I-9 how does this happen? I'm in the middle of hiring an F-1 student on OPT and I need to look at his EAD and verify it's not fake according to my lawyer. So I do. Nice and easy.
Re: The xz backdoor thing reminds me of a story
#4I don't doubt that this happened, but if you use e-verify and fill in Form I-9 how does this happen? I'm in the middle of hiring an F-1 student on OPT and I need to look at his EAD and verify it's not fake according to my lawyer. So I do. Nice and easy.
It says it was a couple decades ago
Re: The xz backdoor thing reminds me of a story
#5I remember a few months ago there was a discussion[1] here about how fossil, the VCS for sqlite, should bring in a dependency on mermaid charts already.
Nothing against mermaid, but I guess supply chain attacks are hard to conceptualise until they happen. When we're shortsighted we risk our mitigations against vague but serious threat models losing out against convenience.
Re: The xz backdoor thing reminds me of a story
#6I don't doubt that this happened, but if you use e-verify and fill in Form I-9 how does this happen? I'm in the middle of hiring an F-1 student on OPT and I need to look at his EAD and verify it's not fake according to my lawyer. So I do. Nice and easy.
Attacker's opsec presumably takes this into account.
Re: The xz backdoor thing reminds me of a story
#7> None of his paychecks were ever cashed
I don't understand this. People were paid by cheque in the early 2000s?
Re: The xz backdoor thing reminds me of a story
#8I don't doubt that this happened, but if you use e-verify and fill in Form I-9 how does this happen? I'm in the middle of hiring an F-1 student on OPT and I need to look at his EAD and verify it's not fake according to my lawyer. So I do. Nice and easy.
Intelligence agencies can presumably mint valid SSNs along with other identity documents to use in situations like this.
Re: The xz backdoor thing reminds me of a story
#9> None of his paychecks were ever cashed I don't understand this. People were paid by cheque in the early 2000s?
You don't have to give your employer a bank account number, but they still have to pay you.
Quite unusual for a tech contractor though.
Re: The xz backdoor thing reminds me of a story
#10> None of his paychecks were ever cashed I don't understand this. People were paid by cheque in the early 2000s?
Yes and many still are