Live data from Hacker News

XZ Backdoor: Times, damned times, and scams

rheaeve.substack.com

101–110 of 193 posts

Re: XZ Backdoor: Times, damned times, and scams

#101

Why not include the timestamps for their replies to the mailing list? https://www.mail-archive.com/xz-devel@tukaani.org/

Do you understand the time format there? It lists things as -700 or -800 for me, is that because of my local time zone (Chicago) vs. the mailing list (Finland?).

Re: XZ Backdoor: Times, damned times, and scams

#102

Earlier quoted context omitted.

Mullvad accepts cash in an envelope with no return address, good luck tracing that

Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.

Departure postal code could be an area with like 1 million people. And if it is a nation state I am sure they could send the mail from another country.

Re: XZ Backdoor: Times, damned times, and scams

#103
post #102

Earlier quoted context omitted.

Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.

Departure postal code could be an area with like 1 million people. And if it is a nation state I am sure they could send the mail from another country.

Most populous US zip code is less than 150K people, https://worldpopulationreview.com/zips

Re: XZ Backdoor: Times, damned times, and scams

#104
post #33

For years I've had `gc` in my terminal mapped to `TZ=UTC0 git commit` for exactly this reason. No need to change system times or git settings. (though perhaps a better way in global config?) It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.

I travel a lot but never change my workstation’s time zone out of PST/PDT these days. That would be a manual step and I don’t use Location Services.

Re: XZ Backdoor: Times, damned times, and scams

#105
Something feels weird about the timezone arithmetic here, though maybe I am nuts. Take this for example:

> Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits.

Putting it all into UTC we get:

    23:38 - 8 = 15:38
    17:27 - 3 = 14:27
That's not 9 hours by my numbers. Or another example:

> Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes!

Putting it all into UTC we get:

    21:53 - 3 = 18:53
    17:00 - 8 = 09:00
I think these timezones were swapped (accidentally) by the article's author. If we do the calculation again:

    21:53 - 8 = 13:53
    17:00 - 3 = 14:00
That _is_ a matter of minutes.

Re: XZ Backdoor: Times, damned times, and scams

#106

> Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits. Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart?

> Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart? Yes, and even worse: > Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes! No, this is a difference of almost 10 hours... Maybe the author inadvertently switched the two analyses? Or maybe the author is just no…

[deleted]

Re: XZ Backdoor: Times, damned times, and scams

#107

I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…

export TZ=Z will just tag all your commits in UTC.

Just a heads up for the next guy...

Re: XZ Backdoor: Times, damned times, and scams

#108
post #37

> who regularly works in the early morning? Me > For a hacker, it is much more plausible to work in the afternoon and late at night c/hacker/younger person

The "hacker" stereotype is certainly stale, but subbing "young person" (and implying not "old person") is equally silly.

I'm 41 and have been awake before 7am maybe 20 times in the past 10 years. Half the reason I still put up with computers is because it's one of the few professions where I can work a 11-7pm schedule most days and still excel.

There are morning people and night people. You are what you are, no judgements, but it isn't something you grow in/out of, nor should be expected to.

Re: XZ Backdoor: Times, damned times, and scams

#109
post #104
post #33

For years I've had `gc` in my terminal mapped to `TZ=UTC0 git commit` for exactly this reason. No need to change system times or git settings. (though perhaps a better way in global config?) It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.

I travel a lot but never change my workstation’s time zone out of PST/PDT these days. That would be a manual step and I don’t use Location Services.

Time zone is purely a displayed time consideration. I'm not bothered that the display time on my computer is different from the time zone I'm actually in.

Re: XZ Backdoor: Times, damned times, and scams

#110
post #32

I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.

“Trust no one! The minute God crapped out the third caveman, a conspiracy was hatched against one of them! ” - Gen. Hunter Gathers, OSI (The Venture Bros.) There are parties who have effectively endless resources and motivation to mock up a false-flag event to steer the responsibility for this a certain way. They're all very, very good at covering their tracks, and even the most experienced security researchers will…

> Never, ever install bleeding-edge software in production, for any reason.

But for any X which is mainstream today someone was always the first of X. And even then being the second or third is still cutting edge. For a certain kind of company it makes sense to play this way, but if it were everyone then we'd have a tragedy.

Post reply on HN