Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reflections on Distrusting xz

joeyh.name

Post reply on HN
Print view View original

331–335 of 335 posts

Re: Reflections on Distrusting xz

#331

Post by Gormo »

kevans91 wrote: post #291
Gormo wrote: post #266

Earlier quoted context omitted.

> Given how easy the infiltration is and how extremely hard to detect it is, likely a lot. This particular case seems to be an example of the exact opposite. It took "Jia Tan" two years to conduct all of the social engineering necessary to get into a position to introduce the backdoor, then upon doing so, was caught almost immediately, with the initial discovery not even coming from a dedicated security researcher, b…

fwiw, characterizing Andres as a sysadmin isn't really the whole picture; he's a postgres developer that conducts benchmarking operations with some frequency (and he's quite good at what he does)... he's perhaps naturally a bit more sensitive to things like the cumulative effect of 500ms or so over a number of sshd invocations.

You're right -- I went back and changed "sysadmin" to "engineer". Either way, though, he was not a dedicated security researcher, and managed to unravel this entire thing upon noticing an anomaly in the course of his regular work.

Re: Reflections on Distrusting xz

#332

Post by tomn »

xign wrote: post #316
tomn wrote: post #137

Earlier quoted context omitted.

Yeah, it's not enforced (and certainly not with linked-in and facebook) but it's really not uncommon to require use of real names for contributions. Linux doesn't allow anonymous contributions: https://www.kernel.org/doc/html/latest/process/submitting-pa... and this guide has been adopted by a lot of GPL-licensed projects (at least openwrt, glibc and gcc).

Wasn't there some controversies around this before? I remember there was some talk of why Asahi Lina (anonymous vtuber working on Asahi Linux) can contribute code to Linux. From casual search: https://www.spinics.net/lists/kernel/msg4888830.html FWIW I like Asahi Lina, just trying to understand the discrepencies

Interesting. My understanding is that these projects don't allow anonymous contributions to make their copyright situation clear, so in theory if marcan42 sent a letter to the linux project saying that contributions from Asahi Lina are actually theirs, they might reasonably be fine with that.

It seems like this is how the ASF runs: you can be anonymous publicly, but you have to sign their CLA (or whatever they call it) properly.

To me, the people trying to unmask Asahi Lina are being simultaneously mean and silly. If it's so obvious that it's marcan42 doing a voice, do you really need to point it out? That's kind of the joke.

Re: Reflections on Distrusting xz

#334

Post by saagarjha »

pdimitar wrote: post #289
saagarjha wrote: post #244

Earlier quoted context omitted.

We don't have the way to apply any restrictions on a per-library basis. This is generally quite difficult to do.

I know. That's what's missing from our current technology. I am honestly tired of everyone collectively pretending this is not a problem. Periodically we get very grim reminders that it's in fact a problem, everyone pretends to care for a month then it's all back to where it was. It's depressing. (And no, this comment does not imply you are such. I am responding + ranting.)

I suspect most of your frustration comes from reading "we don't think this is a good place to spend our effort" as "there are no problems here".

Re: Reflections on Distrusting xz

#335

Post by pdimitar »

saagarjha wrote: post #334
pdimitar wrote: post #289

Earlier quoted context omitted.

I know. That's what's missing from our current technology. I am honestly tired of everyone collectively pretending this is not a problem. Periodically we get very grim reminders that it's in fact a problem, everyone pretends to care for a month then it's all back to where it was. It's depressing. (And no, this comment does not imply you are such. I am responding + ranting.)

I suspect most of your frustration comes from reading "we don't think this is a good place to spend our effort" as "there are no problems here".

Likely. Though people not seeing the problem is quite frustrating by itself.
Post reply on HN