Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reflections on Distrusting xz

joeyh.name

Post reply on HN
Print view View original

171–180 of 335 posts

Re: Reflections on Distrusting xz

#171

Post by ghaff »

nottorp wrote: post #162
ghaff wrote: post #151

Earlier quoted context omitted.

I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing but I also don't generally accept invites from people who are solely professional acquaintances or use it in a purely professional context at all.

> I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing The age of self censorship :) I don't post anything on my FB. I'd still reject any employer who wanted to take a look.

Self-censorship is probably a good thing in many cases. And there are certainly things I don't care to share in writing on any public or semi-public medium.

But I agree that even if I can't keep an employer from sleuthing generally, I don't consider Facebook part of my professional record even if there's nothing on there I'd have a problem with a co-worker or potential co-worker seeing.

Re: Reflections on Distrusting xz

#172

Post by rrr_oh_man »

glitchcrab wrote: post #131
rwmj wrote: post #57

Earlier quoted context omitted.

I mean we go back before all possible sockpuppets. We do have a reasonably good idea of when the attempt started.

The point that the person you replied to is trying to make is how do you know when the repo is clean? How can you ever be sure that someone hasn't introduced a backdoor at some point? It's bigger than just what has been discovered.

By not letting the perfect be the enemy of the good-enough-for-now

Re: Reflections on Distrusting xz

#173

Post by galangalalgol »

mkj wrote: post #154
galangalalgol wrote: post #76

Earlier quoted context omitted.

MS funded people and pipelines to analyze it. Jia Tan convinced them to disable the fuzzing that was designed specifically to find malicious behavior, using social engineering, and one MS engineer did find it.

What were the MS analysis projects? The fuzzing was google-sponsored.

You are correct. The article I read led me to conflate the Azure engineer's valgrind triggered activity with oss-fuzz. Which is as you say a google effort.

Re: Reflections on Distrusting xz

#174

Post by meinersbur »

meinersbur wrote: post #103
rkta wrote: post #84

Earlier quoted context omitted.

What's malicious about that patch? From reading the thread it looks like an attempt to fix a FP from some tooling.

One of the patches that the University of Minnesota was banned for from contributing to the Linux kernel. They were trying to introduce a use-after-free (Fig. 9 in their paper). https://news.ycombinator.com/item?id=26887670

I just had to think about how ironic it would be if "Jia Tan" turned out to be a Post-Doc from the University of Minnesota continuing that research on hypocrite commits.

Re: Reflections on Distrusting xz

#175

Post by fsniper »

iso8859-1 wrote: post #48
fsniper wrote: post #9

It's like security 101. If a system has been infiltrated, you can't trust any part of it. So it's better to discard any part that has been reached or possibly affected. Perhaps it's the correct action to distrust xz/lzma or any source code this team has control over and switch to alternatives. If there are no alternatives, to start ones.

What are your definitions of 'system' and 'any part'? Any big company has been breached at some point. They don't throw away all their hardware everytime, even though it was connected. You have to draw the line somewhere. You're assuming a world with separate hardware and software. That's not the case any more. We have closed sourced firmware running anywhere and no way to verify what's running.

Sure that's a problem for threat assessment process. And I totally agree in today's world software/hardware and wetware are too interconnected. And that's another threat for this kinds of attacks.

In this case, is the whole git repo a threat? Or are just the manually created distribution files? Threat actors' access reach defines that. As time passes by we see that reach is not too limited. They even reached to other software with patches too. So that assessment should be done.

Re: Reflections on Distrusting xz

#176

Post by liendolucas »

loftsy wrote: post #86

I took a look at the diff linked in the article with code that "we are all running". The top of the diff certainly looks interesting. They remove the bounds check in dict_put() and add a safe version dict_put_safe(). This kind of change is difficult to make without mistakes because it silently changes the assumptions made when code calling dict_put() was originally written. ALL call sites would need to be audited to…

I think at this point is clear that everybody has to assume that XZ is completely rotten and can no longer be trusted. Is it XZ easy to replace with some other compression tool? Or has it been so widely adopted that is going to take huge effort moving out of it?

Re: Reflections on Distrusting xz

#177

Post by executesorder66 »

nottorp wrote: post #162
ghaff wrote: post #151

Earlier quoted context omitted.

I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing but I also don't generally accept invites from people who are solely professional acquaintances or use it in a purely professional context at all.

> I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing The age of self censorship :) I don't post anything on my FB. I'd still reject any employer who wanted to take a look.

>> what's on it is no one's -ing business in a professional context.

> The age of self censorship :)

I find this amusing.

I would also like to know what you hoped to achieve by self censoring the word fucking in your message above.

- HN doesn't block posts with any kind of "profanity" filter

- You didn't spare anyone from the profanity, since we all knew exactly what you were saying/thinking

So I'm really curious what that actually achieved.

Re: Reflections on Distrusting xz

#178

Post by dartos »

epr wrote: post #145
irdc wrote: post #8

One thing that comes to mind is that “Jia Tan” might be more accurately seen as a “sleeper” of some sort: a foot soldier who infiltrates a juicy open source project and waits for further instructions; backdooring sshd might not have been part of the original plan. Which raises the concerning question of how much more sleeper maintainers there are.

I've never been concerned about spies infiltrating open source projects compared to legitimate maintainers being hacked, even now after this whole xz incident. I'll put it this way. Let's say a bad guy had a decent budget to spend on paying agents/criminals to break into maintainer's homes on their behalf with a rubber ducky, etc. I'd expect a pretty high success rate compromising their hardware...

You’re ignoring scale.

A single Jia Tian can be infiltrating 10s or more OSS projects each week without needing to travel around the world physically stealing hardware from various maintainers who they then need to impersonate.

They can just impersonate some anons with no real lives or connections and just get the keys to OSS projects given time.

Re: Reflections on Distrusting xz

#179

Post by chjj »

cletus wrote: post #170

The US spends $30-60 billion a year on agriculture and subisides [1]. This is controversial for all the obvious reasons. Without subsidies we'd waste less food but overproduction of food is an intentional objective of these programs. Why? Because if there's a major drought or crops are lost to ice or snow or flooding, Americans won't starve. It's why we have things like the US government having a reserve of over a bi…

I'm not sure why people keep misidentifying the problem as "lack of funding". Lasse Collin was doing fine as a maintainer up until Jia Tan showed up. He was psy-op'd into believing there was a crowd of angry people eagerly awaiting a new release when there wasn't. No real person was unhappy with the way he'd been maintaining xz.

Re: Reflections on Distrusting xz

#180

Post by TheCondor »

ccccccc1 wrote: post #116
craftkiller wrote: post #82

Earlier quoted context omitted.

> killed [...] die or go to jail All of my commits are signed with a PGP key that is on hardware security tokens and password-protected. In the event of my death, my digital identity could not be stolen without backdoors in my hardware security tokens. That being said, $5 wrenches and large sums of money are still possible attack vectors.

A cool tax-free no questions 500k can convince a lot of people

One thing I’ve learned, not from direct experience but from observation. These things are way cheaper than the more ethical and optimistic of us in society think. Your point is totally valid but the number is probably more like $5k-10k.
Post reply on HN