Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

github.com

Post reply on HN
Print view View original

51–60 of 106 posts

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#51

Post by Bluestein »

freedomben wrote: post #43
nindalf wrote: post #33

Earlier quoted context omitted.

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith. Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary,…

> I do hope (perhaps naively) that this (security code reviews) is something AI can get really good at in the future, because that would be a real value add IMHO.

It would offer a good solution, and one that would scale.-

(Until, of course, the AI systems themselves become compromised or weaponized ...

But that is a few arms race cycles away yet.-

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#52

Post by zarathustreal »

freedomben wrote: post #43
nindalf wrote: post #33

Earlier quoted context omitted.

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith. Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary,…

It’s hard to give that answer because after a security breach has happened, you know you made the wrong choice. It’s a tradeoff, as you said, for practicality.

Sometimes you gamble and lose. The bank doesn’t care that “well there was a good chance I was going to be fine” when it comes time to pay your mortgage.

“But I’m the only one that knows the floor plan!” doesn’t quite cut it. Exit the premises and get some therapy.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#53

Post by ahoka »

zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

Because it's September, 1993.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#54

Post by posed »

assbuttbuttass wrote: post #47
zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

People treat Github like social media

It is a social medium by definition, tbf.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#55

Post by renewiltord »

wengo314 wrote: post #37
Macha wrote: post #3

This was discussed at the time of the libxz revelations and they did re-review all commits in light of this: https://github.com/libarchive/libarchive/issues/2103

imho it's embarrassing that this got merged in the first place. it's not a major flaw, and no exploit. but it seems as if nobody paid due attention to actual changes.

Funny how everyone's competent in hindsight and eager to share that.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#56

Post by Bluestein »

assbuttbuttass wrote: post #47
zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

People treat Github like social media

This.-

  PS. And, for some people it might undoubtedly be *all* their "social" ...

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#57

Post by SpaghettiCthulu »

cookiengineer wrote: post #21

It's kind of ridiculous how few lines of code can trigger such a huge and complex discussion about thread safety, where almost all developers involved actually aren't really certain whether or not this can be exploited. I just wish people would stop writing C code for libraries that consume arbitrary data.

In this case it doesn't matter whether it's C or Rust. Both languages, if using their default string formatting facilities, are vulnerable.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#58

Post by turtle_heck »

assbuttbuttass wrote: post #47
zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

People treat Github like social media

That's because it kinda is a social network. You can "follow" people after all.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#59

Post by [deleted] »

freedomben wrote: post #43
nindalf wrote: post #33

Earlier quoted context omitted.

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith. Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary,…

[deleted]

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#60

Post by joh6nn »

prmoustache wrote: post #42
nindalf wrote: post #33

Earlier quoted context omitted.

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

The question is still very relevant. Why are PR like this merged to begin with?

The malicious commit was designed to be confusing, as noted in the first comment of the investigation:

> but calls to safe_fprintf were replaced with calls to the unsafe fprintf. The diff doesn't make this obvious due to the removal of a newline in a parameter list.

It wasn't noticed because it was specifically designed not to be obvious.

Post reply on HN