Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz backdoor thing reminds me of a story

rigor-mortis.nmrc.org

Post reply on HN
Print view View original

71–80 of 99 posts

Re: The xz backdoor thing reminds me of a story

#71

Post by drexlspivey »

skywhopper wrote: post #43
eddd-ddde wrote: post #40

Earlier quoted context omitted.

That is so weird. What is there to set-up about deposit? Can't they just input your account number and send you your money?

It’s even easier to do it the way described. The banks are printing and mailing and processing the checks, which they can do with high efficiency. From the payor’s pov, it’s easier not to worry about tracking account numbers and just using the address which they already know. And the payee doesn’t need to share their bank info.

> From the payor’s pov, it’s easier not to worry about tracking account numbers and just using the address which they already know.

The account number is on the invoice..

Re: The xz backdoor thing reminds me of a story

#72

Post by akira2501 »

roenxi wrote: post #65
jddj wrote: post #5

I remember a few months ago there was a discussion[1] here about how fossil, the VCS for sqlite, should bring in a dependency on mermaid charts already. Nothing against mermaid, but I guess supply chain attacks are hard to conceptualise until they happen. When we're shortsighted we risk our mitigations against vague but serious threat models losing out against convenience. [1] https://news.ycombinator.com/item?id=388…

Well... supply chain attacks are trivial to anticipate. A lot of modern programming (I'm thinking JavaScript especially when I say this) involves what seems to be 100s of dependencies. If there is a 1% chance of a random repo having a backdoor, the project will be compromised. That is clear and obvious. The problem is that the people who act on this and minimise dependencies are at a significant economic disadvantage…

> The problem is that the people who act on this and minimise dependencies are at a significant economic disadvantage to those who don't

People say this, but it my experience, it simply isn't true. You're at a _slight_ economic disadvantage, and if you anticipate it, and correctly staff and plan for it, it's entirely manageable. The huge win is that in the long run you are massively more productive and you're not held back by framework incompatibilities, version updates, or web standards changing faster than you can keep up.

Many shops don't have the mentality or the expertise to actually do this, partly I feel because this canard as taken as rank truth and no one ever dares to challenge it. Web standards have gotten much better in the past 10 years, they're actually pleasant and useful now.

> we're talking massive differentials in productivity

You have an ability to get something that feels "fully featured" off the ground more quickly. I'd wait for the actual user reviews before I make a decision on the quality of the output.

Re: The xz backdoor thing reminds me of a story

#73

Post by dilyevsky »

Aaargh20318 wrote: post #13
greyface- wrote: post #8

Earlier quoted context omitted.

Intelligence agencies can presumably mint valid SSNs along with other identity documents to use in situations like this.

They can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.

They can and also now you know why they use specific countries like Brazil, etc to forge fake identities (other than the fact it’s easier to mask the accent / cultural things). Also not all passports are chipped - it is not a requirement for us visa, only vwp

Re: The xz backdoor thing reminds me of a story

#74

Post by pklack »

Aaargh20318 wrote: post #13
greyface- wrote: post #8

Earlier quoted context omitted.

Intelligence agencies can presumably mint valid SSNs along with other identity documents to use in situations like this.

They can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.

The likely approach would probably be less technical and more covert ops, tricking the target country into issuing a (technically) genuine passport. No need to break encryption/signing this way.

Re: The xz backdoor thing reminds me of a story

#75

Post by eszed »

eddd-ddde wrote: post #49
skywhopper wrote: post #43

Earlier quoted context omitted.

It’s even easier to do it the way described. The banks are printing and mailing and processing the checks, which they can do with high efficiency. From the payor’s pov, it’s easier not to worry about tracking account numbers and just using the address which they already know. And the payee doesn’t need to share their bank info.

Surely a check takes longer, right? "Printing, mailing and processing" doesn't quite scream efficiency to me.

It does. The US banking system is still predicated on paper checks, however, and efforts to change that face considerable inertia. There have been posts on HN explaining how (insanely) it all works.

Re: The xz backdoor thing reminds me of a story

#76

Post by eszed »

furyofantares wrote: post #16
curiousgal wrote: post #7

> None of his paychecks were ever cashed I don't understand this. People were paid by cheque in the early 2000s?

I certainly got checks at internships in 1999-2000 and at a job I briefly held in 2001. I guess my first real-real job was 2006 and for sure I got checks for at least the first few months. It was a mild pain to do the (literal) paperwork for direct deposit, and a mild pain to receive checks (I'd categorize it as a major pain now, but you were running errands more often then and even at the bank for other crap), so la…

We're approximately the same age, and the first time I held job at which I had the option for direct deposit was 2003. I remember it particularly because I thought it was cool, and evangelized it to co-workers, many of whom did not trust it and opted to continue receiving paper checks.

Re: The xz backdoor thing reminds me of a story

#77

Post by hakdbha »

dspillett wrote: post #59
datascienced wrote: post #37

Earlier quoted context omitted.

It must be bad if you are using your employees as a short term LOC. An inverse payday loan.

Using money you owe for something else for as long as you get away with is hardly alien in business in general. It is why most companies (almost every company?) delay payment of invoices for as long as legally possible, no point losing that fraction of whatever in interest (or interest saved on debt). Heck, with regard to cheques it is why banks held on to 3+ clearing periods on those and other payments for as long a…

[dead]

Re: The xz backdoor thing reminds me of a story

#78

Post by astrange »

DonHopkins wrote: post #23
astrange wrote: post #14

Earlier quoted context omitted.

Was that before or after he told you people were hypnotizing you through the TV and tried to sell you nutritionally complete frozen burritos?

Or before or after he told you Black people are a hate group and White people should stay the hell away from Black people, and how to treat women: The Death of Dilbert and False Claims of White Victimhood: https://time.com/6259311/dilbert-racism-scott-adams/ >“If nearly half of all Blacks are not OK with white people, according to this poll, not according to me, according to this poll,” Adams says calmly in the clip.…

"It's real" and "it's not real" are both poor explanations of gender pay gaps that aren't educational.

Claudia Goldin won a Nobel last year partly for explaining them - a rough summary is whether women work has changed over time (highest when everyone was a farmer, lowest 1950sish, now up again), the pay gap does exist currently and appears to be caused by having children, and prior to having children the current generation of women are paid more likely due to being more educated than men.

The "it doesn't exist" argument is something like "it doesn't exist if you control for job choice and seniority level", which is an example of conditioning on a collider because those things are /caused by/ motherhood, so you can't control for them.

Re: The xz backdoor thing reminds me of a story

#79

Post by toast0 »

jabiko wrote: post #45
noduerme wrote: post #39

Earlier quoted context omitted.

I'm a tech contractor. I prefer payment by check from my clients. Most can't or don't want to set up direct deposit for a part time contractor. Amounts are too large for Zelle, and I don't want to pay the fees for paypal or credit card processing if I can avoid it. My clients usually issue paper checks online. Their bank prints the check and mails it. My receiving address is my bank, which deposits checks for me when…

Maybe I'm a bit to naive since I don't know the US banking system, but at least in the EU you just need to tell someone your IBAN and Name and they can transfer money to your account. Is it that much harder in the US?

There's a couple things going on in the US, IMHO.

Yes, you can get wire transfers or ACH at most banks with a routing number and account number. But wire transfers usually cost money to send, and sometimes cost money to get. Generalized ACH transfers usually come through a service provider, and that costs money too.

Also, the same numbers can be used to credit and debit an account, and also to forge checks. So giving your payment credentials (or writing a check) is a security risk. I'm a little fuzzy on details, but someone at my employer at the time (Facebook) had my payroll data on a device in a laptop bag that got stolen in San Francisco, and as a result I had to be hyper vigilant on checking for unauthorized transactions (or get a new account number, but that's more disruptive, assuming the theft was just normal SF theft, like it probably was)

Re: The xz backdoor thing reminds me of a story

#80

Post by jmb99 »

magicalhippo wrote: post #60
jmb99 wrote: post #50

Earlier quoted context omitted.

At least in Canada, the numbers provided for direct deposit are the same numbers used for direct/pre-authorized debit (i.e. withdrawals). So, while your employer likely wouldn’t abuse that information? People may be wary of giving out those numbers unless absolutely necessary, since someone could indeed drain their bank account. They’re also the same numbers that appear on cheques, so someone could easily forge a che…

> the numbers provided for direct deposit are the same numbers used for direct/pre-authorized debit (i.e. withdrawals) Reading up on that, it seems similar in nature to our AvtaleGiro[1]. While indeed having my account number would allow a business to issue a AvtaleGiro request, it's just a request. I would then have to go to my (online) bank and approve it, including setting up a monthly withdrawal limit. So it can'…

That’s the biggest difference - here there isn’t a request, the money’s just gone. I can of course go through the process of calling my bank, filing a fraud claim, waiting 6-8 weeks and then hopefully getting my money back, but that’s not particularly ideal. Especially since lots (most?) of the population is living paycheck to paycheck, and all that they have is probably sitting in the same bank account that they receive said paycheck in.
Post reply on HN