Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

Post by Bluestein » Wed, Jul 17, 2024, 4:54 PM UTC

r721 wrote: post #30

throw0101c wrote: post #5

Earlier quoted context omitted.

> The user Jia Tan added exploit code to the 'xz' tool as part of a larger deal. Various discussions on this backdoor (in rough chronological order): * Backdoor in upstream xz/liblzma leading to SSH server compromise:† https://news.ycombinator.com/item?id=39865810 * What we know about the xz Utils backdoor that almost infected the world: https://news.ycombinator.com/item?id=39891607 * How the XZ Backdoor Works: https…

>XZ backdoor story – Initial analysis Here are parts 2 and 3 (weren't discussed on HN): >Part 2: Assessing the Y, and How, of the XZ Utils incident (social engineering) https://securelist.com/xz-backdoor-story-part-2-social-engin... >Part 3: XZ backdoor. Hook analysis https://securelist.com/xz-backdoor-part-3-hooking-ssh/113007...

  PS. Or some "unaffiliated" group somewhere is getting their SOF cut off ...

Post by JadeNB » Wed, Jul 17, 2024, 6:48 PM UTC

Bluestein wrote: post #87

JadeNB wrote: post #81

Earlier quoted context omitted.

Why do you write all your periods "." in this post (but not in others, per your comment history) as ".-"?

Hate to bother you with a reply on this, but, since you mention ... I beg to differ, I actually checked.- I'd hate it if I had been less than consistent :) PS. At least from about 2021 on ...

Post by Bluestein » Wed, Jul 17, 2024, 7:07 PM UTC

bediger4000 wrote: post #39

AHTERIX5000 wrote: post #38

Earlier quoted context omitted.

I'd be surprised if China has anything to do with this operation.

Who do you favor? One of the Russian Intel agencies? NSA? The Grugq?

  PS. The GNU GRU?

Post by pas » Wed, Jul 17, 2024, 8:27 PM UTC

prmoustache wrote: post #42

nindalf wrote: post #33

Earlier quoted context omitted.

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

The question is still very relevant. Why are PR like this merged to begin with?

Post by OJFord » Wed, Jul 17, 2024, 9:25 PM UTC

joh6nn wrote: post #41

OJFord wrote: post #26

Earlier quoted context omitted.

I'm not who you asked, but sometimes the comments are more interesting (or perhaps intriguing, enticing, is a better way to put it) than the submission itself. Sometimes of those times my interest in the submission grows with reading some of the discussion, and then I'll read it. (Not to say I always do this, but I do definitely click first into comments more often than I go straight for the article - it allows a muc…

Interesting! But this sounds like an explanation why you read the comments without reading the article, not why you comment without reading, and those aren't inherently the same thing. So to clarify: do you comment on the content of the post without reading it? I'm specifically interested in why people comment on links and articles they didn't read. And for maximum clarity here, I mean commenting on the content of th…