31–40 of 193 posts
Poor Jia. Two whole years of work down the drain. If you're reading this Jia, remember that you miss 100% of the shots you don't take. Chin up, brother.
Who knows how many alter egos the individual behind that online personality has, and what other projects they poisoned through those.
It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.
I dont know what the XZ backdoor is about but, to assume someone putting backdoors into software would work usual working days and hours has to be very naïve. The whole premise of the article is based on a false assumption IMO.
FBI could subpoena GitHub for IP addresses.
Earlier quoted context omitted.
> A bit random, but has there been speculation on why this seemed to only target rpm/deb packaging? I don't think much speculation is needed. RPM and deb catches every Enterprise Linux distribution, to the best of my knowledge. rpm catches Red Hat and all derivatives like CentOS, Alma Linux etc, as well as SuSE, Amazon Linux, and even Microsoft's Mariner Linux (now renamed Azure Linux). deb catches Debian and Ubuntu.…
Sure, but why go to the effort to exclude others? Did they think it would help avoid detection on systems that they didn't care to backdoor?
And to me it's less that they don't care, more that their script probably only works or only has been tested on the ones using .rpm/.deb.
Me
> For a hacker, it is much more plausible to work in the afternoon and late at night
c/hacker/younger person
I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…
the rest is mostly speculation about where else they could have been from given holidays and times
This is an interesting take. Most software engineers I know love to show off their FOSS contributions. It's a place to do what _you_ want to do, free of budgets and MBA interference. I guess in certain parts of the world you probably want to keep that sort of skill set under wraps, though.
I dont know what the XZ backdoor is about but, to assume someone putting backdoors into software would work usual working days and hours has to be very naïve. The whole premise of the article is based on a false assumption IMO.