Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

github.com

Post reply on HN
Print view View original

71–80 of 106 posts

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#71

Post by elric »

poikroequ wrote: post #45
elric wrote: post #4

I'm a little unclear as to why JiaT75's github account still exists? Surely this should be nuked from orbit so that no one accidentally ends up using their shady code?

It's useful to keep it up so the public can scrutinize all their commits and fix anything suspicious.

Sure, but there is zero indication of that on their user page. At the very least the account should be disabled, all repos should be archived, and a big fat warning banner should be prominently visible. The current state of affairs seems irresponsible.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#72

Post by psychoslave »

nindalf wrote: post #33
zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

It seems that blaming victims can really provide some power thrill, to which human can easily become addicted to.

Raising competent empathic well balanced individuals is difficult, to say the least. And it’s not like the so called world leader elites really show they are some paragons of these traits.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#73

Post by [deleted] »

BalinKing wrote: post #50
freedomben wrote: post #43

Earlier quoted context omitted.

I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith. Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary,…

This change doesn’t look like it would’ve required much scrutiny, though… it’s three lines long and seems (admittedly as an uninformed outsider) to be obviously wrong. Like, ignoring the fact that Jia Tan happened to be an adversary, I’m kinda shocked that their code review process let it through—unless the standard quite literally is “recognized contributors get rubber-stamped without further review.”

[deleted]

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#74

Post by chefandy »

joh6nn wrote: post #66
BalinKing wrote: post #50

Earlier quoted context omitted.

This change doesn’t look like it would’ve required much scrutiny, though… it’s three lines long and seems (admittedly as an uninformed outsider) to be obviously wrong. Like, ignoring the fact that Jia Tan happened to be an adversary, I’m kinda shocked that their code review process let it through—unless the standard quite literally is “recognized contributors get rubber-stamped without further review.”

Right, but that was the exact nature of the attack: it's a small commit that doesn't look like it needs a lot of scrutiny. Like, I get that you meant "it wouldn't take much scrutiny to find this" but I mean "it doesn't look like it needs to be scrutinized". Especially because, as mentioned in the first comment of the investigation, the change to an unsafe behavior is deliberately obscured by the formatting of the dif…

Right-- A busy maintainer sees a weird looking commit-- but it's three lines long, submitted from a known contributor, and the tests pass. It was very carefully planned to be innocuous-looking enough to not trigger any concerns with a casual once-over (oh, it just changes the way an error is printed) and obfuscated enough to not be obviously malicious because of the diff formatting, and submitted by a reliable known contributor. Each piece was designed to make a rigorous code review as unlikely as they could possibly make it.

Sure, that's not how it's SUPPOSED to happen, but I'll eat my hat if at least 95% of people who've approved a PR at some point couldn't have been walked down that path by a dedicated attacker over time. Hopefully this has been enough of a jolt to make that less likely the next time someone tries it.

People often cite death and taxes as the only certainties in life-- we could easily include human fallibility.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#75

Post by bthrn »

londons_explore wrote: post #69

Am I the only one a little concerned that no obvious attack has been found from this? It seems doubtful that a state actor is trying to use terminal escape sequences to hide an error message... The state actor wants code execution, not the ability to backspace some warning on a developers terminal. Besides, using such a vulnerability seems far too dangerous - those escape sequences would be plainly obvious in any log…

The goal here is to submit what appears to be a sequence of innocuous changes, none of which on their own are “obvious” vulnerabilities. The truth is, we don’t know what the strategic depths of this actor are. It may be years before we know whether an attack is successful.

For example — and this is just hypothetical - the author may have found that some consumer of this codebase uses it in a script, and consumes console output in some form. By modifying its output to behave differently, they may be able to influence the consumer’s execution in some clever way so as to create other conditions necessary for additional exploitation.

Or - the PR could have just been a test to gauge the scrutiny of the approvers.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#76

Post by keepamovin »

zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

Liberal use of the GH moderations tools, like block user, and interaction limits, is your friend.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#77

Post by Bluestein »

bthrn wrote: post #75
londons_explore wrote: post #69

Am I the only one a little concerned that no obvious attack has been found from this? It seems doubtful that a state actor is trying to use terminal escape sequences to hide an error message... The state actor wants code execution, not the ability to backspace some warning on a developers terminal. Besides, using such a vulnerability seems far too dangerous - those escape sequences would be plainly obvious in any log…

The goal here is to submit what appears to be a sequence of innocuous changes, none of which on their own are “obvious” vulnerabilities. The truth is, we don’t know what the strategic depths of this actor are. It may be years before we know whether an attack is successful. For example — and this is just hypothetical - the author may have found that some consumer of this codebase uses it in a script, and consumes cons…

The "funny" thing here is that this is (somewhat, perhaps?) how an AI intelligent beyond human capacity might execute an attack - or what an attack by one such might feel like: Lots of apparently unrelated actions, many or all of which make no sense ...

... (until and if you see the larger picture, which might be insurmountably difficult ...

... this, coupled with AI-level scalability of social engineering, at AI-level scale -and- with an AI-level understanding of "known-outcomes" that might be desirable towards given goals: "Leader change", etc.-)

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#78

Post by ivanjermakov »

AshamedCaptain wrote: post #46
ivanjermakov wrote: post #28

Earlier quoted context omitted.

This is why a lot of projects use other tools for bug tracking and merging, e.g. bugzilla, youtrack, atlassian etc.

The opposite. Whenever some project migrates to an inferior alternative like Github or Discord they always claim a number of arguments which boil down to "it's where people go these days" (e.g. less friction for newcomers, most people have an account there already, larger community, whatever excuse you can come up). So I say they are getting exactly what they wanted to get.

> less friction for newcomers

This is exactly the problem. If you want your resort be vandalized, build a nice road to it.

And some orgs are even eager to fuel this with things like Hacktoberfest.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#79

Post by bibinou »

joh6nn wrote: post #70
bibinou wrote: post #49

Earlier quoted context omitted.

Karma farming.

Ok, but to what end? Is there some karma-to-dollars pipeline that I don't know about? There a bunch of other platforms that superficially seem like much softer targets with more obvious payoffs. Like, if we put it in the classic context of 1. Farm Karma 2. ? 3. Profit! I'm not clear on step 2. What's step 2 And of course that pre-supposes malice (or at least greed), which is in violation of Hanlon's Razor.

Coincidentally, Reddit (YC05) IPO'ed in March so I'm sure you'll find plenty of analysis on that.

Gallowboob reportedly got paid https://knowyourmeme.com/memes/people/gallowboob>.

It used to be called Curation, Marketing, or Expert Advice but it's been algorithmified to death.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#80

Post by keybored »

> The diff doesn't make this obvious due to the removal of a newline in a parameter list.

I like to separate every little intentional change into their own commits. So a formatting change would be separated into its own commit.

If you are looking for “red flags” notice if the diff is clean or not according to what you expect to see changed; if you only expect to see some error text change then multiple lines being changed is weird. Also use a decent diff viewer which is somewhat content/language-aware.

Post reply on HN