Half a Second – a book about the XZ backdoor
half-second.com
Half a Second – a book about the XZ backdoor
1–10 of 54 posts
Re: Half a Second – a book about the XZ backdoor
#2Given the time and effort that went into this, and the luck that one diligent person noticed, investigated and discovered what was going on before it could get further... it seems very likely to me that this has happened already in other libraries without being discovered.
Re: Half a Second – a book about the XZ backdoor
#3Given the time and effort that went into this, and the luck that one diligent person noticed, investigated and discovered what was going on before it could get further... it seems very likely to me that this has happened already in other libraries without being discovered.
Exactly, and I wonder since then: How closely did people in comparable situations look? Since nothing similar has been reported, I suspect not very close…
Re: Half a Second – a book about the XZ backdoor
#4It's only going to recycle old news. The missing piece is attribution. Had it been the usuals (DPRK, Russia, China), the attribution would have been made publicly. The fact that is has not points as a friendly - especially when Microsoft (who owns Github) had all that telemetry and very likely has the means to find out. Some serious OSINT (consistency of timezone across months if not years of commits) pointed to the Middle East. An obvious Unit name comes to mind.
Re: Half a Second – a book about the XZ backdoor
#5> The catch is where the book begins, not what it is about.
Re: Half a Second – a book about the XZ backdoor
#6Well, the "About the Author" section should probably just be a link to claude.ai.
Re: Half a Second – a book about the XZ backdoor
#7It's only going to recycle old news. The missing piece is attribution. Had it been the usuals (DPRK, Russia, China), the attribution would have been made publicly. The fact that is has not points as a friendly - especially when Microsoft (who owns Github) had all that telemetry and very likely has the means to find out. Some serious OSINT (consistency of timezone across months if not years of commits) pointed to the…
Fun fact: the guy who reported it (Andres Freund) works for Microsoft.
Another fun fact: Moscow is in the same time zone as the Middle East.
Re: Half a Second – a book about the XZ backdoor
#8Well, the "About the Author" section should probably just be a link to claude.ai.
Yeah the (annoyingly) excessive use of colons feels like recent Claude models to me.
Looks like author posted this themselves earlier, and even used Claude for the HN comment:
Re: Half a Second – a book about the XZ backdoor
#9So Microsoft did something good? I thought they are too busy keeping my personal data in a prison and writing tight bash loops wasting 100 percent of a core
Re: Half a Second – a book about the XZ backdoor
#10Well, the "About the Author" section should probably just be a link to claude.ai.
Yeah the (annoyingly) excessive use of colons feels like recent Claude models to me. Looks like author posted this themselves earlier, and even used Claude for the HN comment: https://news.ycombinator.com/item?id=48958457
I've always used a lot of semi-colons in my writing, especially in my technical writing. So I did a search on this pdf for semi colons, and there are 260 in a 264 page document. I then repeated this for the last book I read, Candide by Voltaire, and there were 507 semi colons in a 189 page book.
This seems like a witch hunt.