Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ Backdoor: Times, damned times, and scams

rheaeve.substack.com

Post reply on HN
Print view View original

131–140 of 193 posts

Re: XZ Backdoor: Times, damned times, and scams

#131

Post by naruhodo »

lapcat wrote: post #112
jtuple wrote: post #108

Earlier quoted context omitted.

The "hacker" stereotype is certainly stale, but subbing "young person" (and implying not "old person") is equally silly. I'm 41 and have been awake before 7am maybe 20 times in the past 10 years. Half the reason I still put up with computers is because it's one of the few professions where I can work a 11-7pm schedule most days and still excel. There are morning people and night people. You are what you are, no judge…

> There are morning people and night people. You are what you are, no judgements, but it isn't something you grow in/out of, nor should be expected to. Oh, my sweet summer child. Talk to me again in another decade or so.

I'm in my mid fifties. I rarely start work before 2pm. My colleagues regularly receive emails from me sent after 1am.

Are you saying I will grow out of this and become a lark? Or are you saying I will eventually conform, oh wise one?

Re: XZ Backdoor: Times, damned times, and scams

#132

Post by 1letterunixname »

krick wrote: post #76
tiahura wrote: post #57

Earlier quoted context omitted.

Don't worry, they (it's a team) also contribute to image libraries, webkit, Kubernetes, ...

Yes, unironically, that, being a huge leak, really convinces me that we all have multiple RCEs on each of our systems. I mean, we already kinda knew that, of course, but even now that I'm typing this it's a bit hard for me to actually believe it. But realistically I think it's pretty much a proven fact. This level of sophistication… what did I even expect? Of course well-payed teams of high-level professionals are wo…

I never understood and continue to be baffled by the naïveté of FOSS people giving commit access to core projects to unknown parties. Assume they're a state actor or a crazy person, until proven otherwise.

Re: XZ Backdoor: Times, damned times, and scams

#133

Post by pquki4 »

transpute wrote: post #103
jeltz wrote: post #102

Earlier quoted context omitted.

Departure postal code could be an area with like 1 million people. And if it is a nation state I am sure they could send the mail from another country.

Most populous US zip code is less than 150K people, https://worldpopulationreview.com/zips

I mean, even if I live in Manhattan, I can easily take a subway train to an area with a different zip code and mail it there. And that's almost the easiest thing you could do -- if you want to hide where the mail is from, it is trivial.

Re: XZ Backdoor: Times, damned times, and scams

#134

Post by fbdab103 »

1letterunixname wrote: post #132
krick wrote: post #76

Earlier quoted context omitted.

Yes, unironically, that, being a huge leak, really convinces me that we all have multiple RCEs on each of our systems. I mean, we already kinda knew that, of course, but even now that I'm typing this it's a bit hard for me to actually believe it. But realistically I think it's pretty much a proven fact. This level of sophistication… what did I even expect? Of course well-payed teams of high-level professionals are wo…

I never understood and continue to be baffled by the naïveté of FOSS people giving commit access to core projects to unknown parties. Assume they're a state actor or a crazy person, until proven otherwise.

That effectively means you cannot share commit rights with anybody. How am I supposed to vet someone as not a state actor? Any plausible test could be thwarted by a motivated individual.

Re: XZ Backdoor: Times, damned times, and scams

#135

Post by gfaure »

4bpp wrote: post #94

GMT+8, the name (Mandarin/mixed-dialect first name + Hokkien surname) and most importantly the circumstance that the user was seen connecting from a likely VPN exit or hosted server in Singapore [1] are all consistent with a Singaporean identity, whether real or cover. For that reason, the opinion of [1]'s source that the name sounds fake should also be taken with some amount of salt (Mainland Chinese are not always…

It's also worth noting that Tan is a Mandarin Chinese surname too (譚) in addition to being a distinct Hokkien surname (the much more common 陳).

Re: XZ Backdoor: Times, damned times, and scams

#136

Post by thrdbndndn »

ShamelessC wrote: post #62
thrdbndndn wrote: post #24

I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…

> understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't People who don’t read the article and find themselves lacking an informed or nuanced understanding of the contents of said article are the only ones to blame here. Full stop. That HN doesn’t have a culture of shaming those who don’t read the article is partly the fault of the rules here…

By that logic there is also nothing wrong with clickbaity titles, which I disagree.

Re: XZ Backdoor: Times, damned times, and scams

#137

Post by dustyharddrive »

jcranmer wrote: post #124
cozzyd wrote: post #111

Earlier quoted context omitted.

Anyone try emailing with a tracking image?

No need to bother with a tracking image. Just scour the message headers of any message sent in the past--there's decent chance there's a few more dates lurking in those headers, and even an IP address or two.

Headers have the IP address of their mail service.

Re: XZ Backdoor: Times, damned times, and scams

#138

Post by hnthrowaway0328 »

bradleyjg wrote: post #52
mik1998 wrote: post #32

I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.

What about the daylight savings time and holidays points? How do they line up for Israel?

Israelis usually are off on Fridays so it doesn't match the git commit records.

Re: XZ Backdoor: Times, damned times, and scams

#139

Post by lapcat »

naruhodo wrote: post #131
lapcat wrote: post #112

Earlier quoted context omitted.

> There are morning people and night people. You are what you are, no judgements, but it isn't something you grow in/out of, nor should be expected to. Oh, my sweet summer child. Talk to me again in another decade or so.

I'm in my mid fifties. I rarely start work before 2pm. My colleagues regularly receive emails from me sent after 1am. Are you saying I will grow out of this and become a lark? Or are you saying I will eventually conform, oh wise one?

I'm saying that changing sleep patterns and waking up earlier is a very common effect of aging.

https://www.sleepfoundation.org/aging-and-sleep/why-do-older...

YMMV but the idea that you can't grow in/out of sleep patterns is empirically false, and I know this from personal experience.

For most of my life, I didn't need glasses for reading... until I suddenly did. Bodies change.

Re: XZ Backdoor: Times, damned times, and scams

#140

Post by kijin »

> you will often not be able to change the time without adding latency, i.e., withholding commits and thus delaying project development -- and even then, getting it right every time is hard.

Someone with access to the right machines could easily check whether this is the case. A lot of projects have set up webhooks on github to sync new commits with their own bug tracker, for example, or testing infrastructure. Logs on these systems would tell you exactly when the commits were pushed.

Post reply on HN