I'm a little unclear as to why JiaT75's github account still exists? Surely this should be nuked from orbit so that no one accidentally ends up using their shady code?
Labeling - bringing up the actor, and the method involved - is useful.-
Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
61–70 of 106 posts
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#62GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…
GH needs a system like most forum communities have where comments can be put in a moderation / approval queue before being public.
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#63People in the Western world are comfortable and people in China are very motivated. I've been reading "the man who solved the market" about Jim Simons and his hedge fund Renaissance. This reminds me that there was a period just after the fall of the Soviet Union where Renaissance was flooded with very technically strong, very motivated, very hard working, and very fraudulent ex-USSR people. They're leaking guys, wake…
I'd be surprised if China has anything to do with this operation.
That is actually a thought.-
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#64[deleted]
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#65GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…
This is why a lot of projects use other tools for bug tracking and merging, e.g. bugzilla, youtrack, atlassian etc.
Apache Foundation maintains a lengthy list of capable projects ... shout out to TRAC first
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#66Earlier quoted context omitted.
I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith. Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary,…
This change doesn’t look like it would’ve required much scrutiny, though… it’s three lines long and seems (admittedly as an uninformed outsider) to be obviously wrong. Like, ignoring the fact that Jia Tan happened to be an adversary, I’m kinda shocked that their code review process let it through—unless the standard quite literally is “recognized contributors get rubber-stamped without further review.”
Right, but that was the exact nature of the attack: it's a small commit that doesn't look like it needs a lot of scrutiny. Like, I get that you meant "it wouldn't take much scrutiny to find this" but I mean "it doesn't look like it needs to be scrutinized". Especially because, as mentioned in the first comment of the investigation, the change to an unsafe behavior is deliberately obscured by the formatting of the diff.
It's like Where's Wal(do|ly): once you know where to look, it's obvious, but if you don't even know you're supposed to be looking for it, you may never find it
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#67GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…
I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…
I recently removed the arm rests from my shitty IKEA chair (to apply WD40 silicone, because the standard cheap mechanism was creaking every time I leaned back, even if it was locked), and decided not to put them back, because they incentivized slouching
so akcheually some people are sitting on a block of concrete!
theorizing that it was wrong to merge in itself is not victim blaming. but of course piling up in GH discussions and issues unconstructively, and just expressing opinions is bullying.
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#68GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…
People treat Github like social media
It seems like GitHub encourages that? I mean, emoji reacts to issue comments? Not really sure what the point of that is besides "driving engagement".
I guess the argument for it is that it lets people easily "get involved"? Seems like there's some merit to making it easy for users to leave feedback. Maybe thumbs-up or thumbs-down on an issue really is valuable feedback in some situations. I'm torn between saying the social features are bad because they lower the barrier for low quality engagement, and saying that even low quality engagement can lead to valuable insights.
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#69Am I the only one a little concerned that no obvious attack has been found from this?
It seems doubtful that a state actor is trying to use terminal escape sequences to hide an error message... The state actor wants code execution, not the ability to backspace some warning on a developers terminal. Besides, using such a vulnerability seems far too dangerous - those escape sequences would be plainly obvious in any log file or any inspection of files on-disk.
And at the same time, if you are an undercover state actor, there is no point in potentially revealing yourself by inserting some security problem that isn't exploitable.
Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
#70I'm confused why this is being posted now? This thread appears to have taken place in the days immediately following the original XZ discovery, with no new activity since very early April. It was discussed heavily at the time that Jia Tan had made contributions to other projects and that those were being investigated as well. Is there something new here I missed, or some additional context that makes this specific co…
Karma farming.
Ok, but to what end? Is there some karma-to-dollars pipeline that I don't know about? There a bunch of other platforms that superficially seem like much softer targets with more obvious payoffs.
Like, if we put it in the classic context of
1. Farm Karma
2. ?
3. Profit!
I'm not clear on step 2. What's step 2
And of course that pre-supposes malice (or at least greed), which is in violation of Hanlon's Razor.