Why not include the timestamps for their replies to the mailing list? https://www.mail-archive.com/xz-devel@tukaani.org/
XZ Backdoor: Times, damned times, and scams
101–110 of 193 posts
Re: XZ Backdoor: Times, damned times, and scams
#102Earlier quoted context omitted.
Mullvad accepts cash in an envelope with no return address, good luck tracing that
Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.
Re: XZ Backdoor: Times, damned times, and scams
#103Earlier quoted context omitted.
Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.
Departure postal code could be an area with like 1 million people. And if it is a nation state I am sure they could send the mail from another country.
Re: XZ Backdoor: Times, damned times, and scams
#104For years I've had `gc` in my terminal mapped to `TZ=UTC0 git commit` for exactly this reason. No need to change system times or git settings. (though perhaps a better way in global config?) It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.
Re: XZ Backdoor: Times, damned times, and scams
#105> Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits.
Putting it all into UTC we get:
23:38 - 8 = 15:38
17:27 - 3 = 14:27
That's not 9 hours by my numbers. Or another example:> Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes!
Putting it all into UTC we get:
21:53 - 3 = 18:53
17:00 - 8 = 09:00
I think these timezones were swapped (accidentally) by the article's author. If we do the calculation again: 21:53 - 8 = 13:53
17:00 - 3 = 14:00
That _is_ a matter of minutes.Re: XZ Backdoor: Times, damned times, and scams
#106> Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits. Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart?
> Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart? Yes, and even worse: > Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes! No, this is a difference of almost 10 hours... Maybe the author inadvertently switched the two analyses? Or maybe the author is just no…
Re: XZ Backdoor: Times, damned times, and scams
#107I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…
Just a heads up for the next guy...
Re: XZ Backdoor: Times, damned times, and scams
#108> who regularly works in the early morning? Me > For a hacker, it is much more plausible to work in the afternoon and late at night c/hacker/younger person
I'm 41 and have been awake before 7am maybe 20 times in the past 10 years. Half the reason I still put up with computers is because it's one of the few professions where I can work a 11-7pm schedule most days and still excel.
There are morning people and night people. You are what you are, no judgements, but it isn't something you grow in/out of, nor should be expected to.
Re: XZ Backdoor: Times, damned times, and scams
#109For years I've had `gc` in my terminal mapped to `TZ=UTC0 git commit` for exactly this reason. No need to change system times or git settings. (though perhaps a better way in global config?) It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.
I travel a lot but never change my workstation’s time zone out of PST/PDT these days. That would be a manual step and I don’t use Location Services.
Re: XZ Backdoor: Times, damned times, and scams
#110I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.
“Trust no one! The minute God crapped out the third caveman, a conspiracy was hatched against one of them! ” - Gen. Hunter Gathers, OSI (The Venture Bros.) There are parties who have effectively endless resources and motivation to mock up a false-flag event to steer the responsibility for this a certain way. They're all very, very good at covering their tracks, and even the most experienced security researchers will…
But for any X which is mainstream today someone was always the first of X. And even then being the second or third is still cutting edge. For a certain kind of company it makes sense to play this way, but if it were everyone then we'd have a tragedy.