Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reflections on Distrusting xz

joeyh.name

Post reply on HN
Print view View original

271–280 of 335 posts

Re: Reflections on Distrusting xz

#271

Post by Gormo »

Cthulhu_ wrote: post #190
chjj wrote: post #179

Earlier quoted context omitted.

I'm not sure why people keep misidentifying the problem as "lack of funding". Lasse Collin was doing fine as a maintainer up until Jia Tan showed up. He was psy-op'd into believing there was a crowd of angry people eagerly awaiting a new release when there wasn't. No real person was unhappy with the way he'd been maintaining xz.

Funding aside, single individuals being responsible for software is not a good thing, see bus factor.

In fact, there was no issue with Lasse Collin maintaining xz as a single individual, and creating a false impression to the contrary was the primary tactic used by the antagonist to gain access to the project.

Re: Reflections on Distrusting xz

#272

Post by liendolucas »

dralley wrote: post #221
liendolucas wrote: post #205

Earlier quoted context omitted.

What keeps ringing in my head is the "." that was found that invalidates compilation. I personally don't buy it (but is my opinion).

What do you mean "don't buy it"?

My bad. I thought that the person who made that commit was someone else than JT. Can't delete comment nor self-down-vote it.

Re: Reflections on Distrusting xz

#274

Post by formerly_proven »

kzrdude wrote: post #250
rthnbgrredf wrote: post #188

Earlier quoted context omitted.

Arch Linux has replaced it with zstd in 2020 already. It's doable for the next major release of Debian.

Certainly, but we need an xz decompressor to read the current debian repo versions for the next decades, when they are oldstable or archived.

Decoding is easy.

Re: Reflections on Distrusting xz

#275

Post by beardedwizard »

swed420 wrote: post #259
mrkramer wrote: post #140

Earlier quoted context omitted.

My assumption is that this was state sponsored mass surveillance campaign of some kind but God knows what exactly they were looking for. I think if backdoor was discovered 2 or 3 months later, we maybe could understand better what they wanted to do. My speculation is that they wanted to build a massive botnet and then snoop on machines' processes and traffic looking for something. It's hard to speculate because lucki…

I find it intriguing that out of all the speculative comment threads I've read so far, none of them have suggested it was Microsoft attempting to make FOSS look bad/vulnerable.

How would that benefit Microsoft, who owns GitHub, the home of OSS? It's not a secret that oss is vulnerable, the opportunity for MS is to sell the solution to a captive audience.

Re: Reflections on Distrusting xz

#276

Post by lakomen »

I'm disappointed, to put it very mildly how archlinux handled the matter. They still use version 5.6.1 and assume that switching from github to the one hosted by Lasse fixes the issue. They say "our sshd isn't compromised". But what the author of this article wrote, who knows what else might be affected. There's a forum post on the archlinux forum, which was closed by ewaller, an administrator account, with a weird reason, that this thread was only to inform people, but when people started calling out the malpractice of the archlinux maintainers the thread got locked.

To me, this is very suspicious.

Re: Reflections on Distrusting xz

#277

Post by nottorp »

jcurtis wrote: post #253
nottorp wrote: post #214

Earlier quoted context omitted.

That one amuses me because of a character in a (iirc) fantasy book that swore all the time but used just -ing everywhere. Sadly I don’t remember what character of which book…

It's Mr Tulip, of Terry Pratchett's The Truth .

Thank you! I was pretty sure it was Pratchett (but not which book and character) but I self censored in case i was wrong :)

Re: Reflections on Distrusting xz

#278

Post by swed420 »

beardedwizard wrote: post #275
swed420 wrote: post #259

Earlier quoted context omitted.

I find it intriguing that out of all the speculative comment threads I've read so far, none of them have suggested it was Microsoft attempting to make FOSS look bad/vulnerable.

How would that benefit Microsoft, who owns GitHub, the home of OSS? It's not a secret that oss is vulnerable, the opportunity for MS is to sell the solution to a captive audience.

Microsoft making the decision to own GitHub in the first place also speaks to my suspicion. Embrace, Extend, Extinguish.

Re: Reflections on Distrusting xz

#279

Post by dullcrisp »

david_draco wrote: post #202
constantcrying wrote: post #62

Earlier quoted context omitted.

>Which raises the concerning question of how much more sleeper maintainers there are. Given how easy the infiltration is and how extremely hard to detect it is, likely a lot. For an intelligence operation it is also extremely cheap, you just need a few knowledgeable developers spending some time each week on the project. The upside being a backdoor into a significant portion of infrastructure, the downside being wast…

> Given how easy the infiltration is and how extremely hard to detect it is, likely a lot. I read it exactly the other way around: the infiltration took years and detecting it was the default with a fuzzer, which had to be disabled for the exploit to succeed. It speaks to the hardening and that hardening should be required more. And of course the precarious roles of maintainers, which have been discussed elsewhere.

The exploit could be detected with a fuzzer perhaps. The infiltration seems like it was something that would be very easy for a funded intelligence agency to do, and would be nigh undetectable if they had been subtly introducing bugs rather than shipping a sophisticated backdoor to every Linux distro.

You have to assume if this was an intelligence agency they didn’t burn their only agent like this.

Re: Reflections on Distrusting xz

#280

Post by constantcrying »

Gormo wrote: post #266
constantcrying wrote: post #62

Earlier quoted context omitted.

>Which raises the concerning question of how much more sleeper maintainers there are. Given how easy the infiltration is and how extremely hard to detect it is, likely a lot. For an intelligence operation it is also extremely cheap, you just need a few knowledgeable developers spending some time each week on the project. The upside being a backdoor into a significant portion of infrastructure, the downside being wast…

> Given how easy the infiltration is and how extremely hard to detect it is, likely a lot. This particular case seems to be an example of the exact opposite. It took "Jia Tan" two years to conduct all of the social engineering necessary to get into a position to introduce the backdoor, then upon doing so, was caught almost immediately, with the initial discovery not even coming from a dedicated security researcher, b…

I don't think you are looking at it the right way. Two years matter if you are a hobbyist or your goal is to compromise the system for some individual gain.

For a nation state actor two years is nothing. Likely the entire attack didn't cost more than a couple of thousand hours of developer time. I would guess it was easily cheaper than 100k in financial terms, that is extremely efficient for an intelligence operation with the upside being access to a large amount of servers.

The method by which he got caught also depended largely upon random chance, some major "if's" needed to happen, the performance reduction was an unfortunate side effect from the perspective of the attacker, really a minor mistake exposed him. Even if he were exposed a couple months later the damage would have been enormous, if that version had become a stable part of any major distro for the next few years hundreds of thousands of machines would have been vulnerable.

There is absolutely no reason to assume that if another attack of this quality happens it will not find it's way into some stable distro.

Post reply on HN