Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

github.com

Post reply on HN
Print view View original

11–20 of 106 posts

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#11

Post by Sebb767 »

peanut_worm wrote: post #6

why wouldn’t they just immediately reject it if they know its the same guy from the xz thing?

The PR is originally from 2021 and has been merged back then, but there's more recent discussion on it about whether this introduces a vulnerability.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#15

Post by falqun »

elric wrote: post #4

I'm a little unclear as to why JiaT75's github account still exists? Surely this should be nuked from orbit so that no one accidentally ends up using their shady code?

The deletion of the account would not delete commits associated with it. The commit would still contain everything potentially malicious, plus a reference to an account that would be deleted. Which is actually worse, you cant track what code a malicious actor has contributed (easily). So the correct thing to do is take away login / deactivate the account, and then start going through all contributions and check them via the account that references all of this.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#18

Post by joh6nn »

peanut_worm wrote: post #9
H8crilA wrote: post #7

Earlier quoted context omitted.

[2021]

good thing that was in the title

Asking in seriousness: did you comment without reading the link? If so, why? I legit don't understand why people comment on things without having read them, and I would like to

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#20

Post by joh6nn »

I'm confused why this is being posted now? This thread appears to have taken place in the days immediately following the original XZ discovery, with no new activity since very early April. It was discussed heavily at the time that Jia Tan had made contributions to other projects and that those were being investigated as well.

Is there something new here I missed, or some additional context that makes this specific commit relevant right now?

Post reply on HN