Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Half a Second – a book about the XZ backdoor

half-second.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: Half a Second – a book about the XZ backdoor

#21

Post by jstanley »

infinite_spin wrote: post #10
sevg wrote: post #8

Earlier quoted context omitted.

Yeah the (annoyingly) excessive use of colons feels like recent Claude models to me. Looks like author posted this themselves earlier, and even used Claude for the HN comment: https://news.ycombinator.com/item?id=48958457

I've always used a lot of semi-colons in my writing, especially in my technical writing. So I did a search on this pdf for semi colons, and there are 260 in a 264 page document. I then repeated this for the last book I read, Candide by Voltaire, and there were 507 semi colons in a 189 page book. This seems like a witch hunt.

I pasted the introduction into Pangram and it said 100% AI.

Re: Half a Second – a book about the XZ backdoor

#22

Post by infinite_spin »

rwmj wrote: post #19
infinite_spin wrote: post #16

Earlier quoted context omitted.

the argument was that use of semi-colons indicates AI usage.. what do you mean by "being first hand involved in all this"? what part did you take if you don't mind sharing, this was an incredibly interesting turn of events.

You'd know that if you'd done any research at all. Compare this to Jeff Guo (NPR) or Henry van Dyck (Veritasium) or my contact at the WSJ. They all investigated this story, interviewed key people (more people were interviewed for the Veritasium video than appeared), and fact-checked everything with subject matter experts. The NPR story took about 3 months of work and the Veritasium video took 5 months. I was intervie…

> You'd know that if you'd done any research at all.

I'm not in the habit of researching the people who respond to me before I ask them about what their role was in something they seem proud of. I thought I was being polite by asking about it.

That's really cool that you were interviewed, which of the interviews do you think most represents your hand in this? I wouldn't mind checking it out. I also really like Veritasium's channel, that's pretty awesome.

Re: Half a Second – a book about the XZ backdoor

#23

Post by dhx »

See [1] for April 2024 Clickhouse Github activity analysis of the xz backdoor.

I haven't seen anyone write up a proper analysis that includes consideration of:

- GitHub activity (e.g. all API actions on GitHub side including replying to comments) _and_ mailing list activity _and_ other public facing activity all considered together.

- Complexity of public actions e.g. was there a queue of code changes that would have taken 20 hours effort to put together that were all committed at once? Were there any long streaks of high activity where it might reveal how many people were involved?

- Latency of public actions e.g. if an issue was raised by some random person, how long did it take for the attacker to respond, and later resolve/commit a patch? Similar to the complexity of public actions, it might reveal how many people were involved by estimation of the time needed for an experienced developer to fix an issue vs. actual time taken, both in terms of level of effort and duration.

- International dispersement of a team in different timezones with some core hours for collaboration, review and public facing activity.

- Public holidays, country/region-specific work habits, etc--e.g. consideration of "summer holiday" periods or similar common holiday periods, consideration of unusual days of no/low activity versus snow days, power outages, etc which might have been experienced by the attacker.

Distribution of actions from Github indicates the attacker used a 6 day work week excluding Sunday, and almost all activity conducted between UTC 12:00-16:00. Within these 6 days, activity was uneven at 0.5, 1, 1, 1, 1, 0.5 effort per day. There are low activity periods too that line up with summer solstice (southern hemisphere) or winter solstice (northern hemisphere).

There are interesting patterns in the data not yet publicly analysed (I think?) that seemingly would reveal the true location of attackers, particularly because attacker actions are anchored to uncontrollable events such as a known-good contributor (such as Linux distro maintainer) raising a Github issue against a repository and the attacker replying an hour later. For such events with low latency of reply, it'd be well worth considering when a reply was made quickly, and when it wasn't, across a few years of data points.

[1] https://news.ycombinator.com/item?id=39905375

Re: Half a Second – a book about the XZ backdoor

#24

Post by sevg »

infinite_spin wrote: post #10
sevg wrote: post #8

Earlier quoted context omitted.

Yeah the (annoyingly) excessive use of colons feels like recent Claude models to me. Looks like author posted this themselves earlier, and even used Claude for the HN comment: https://news.ycombinator.com/item?id=48958457

I've always used a lot of semi-colons in my writing, especially in my technical writing. So I did a search on this pdf for semi colons, and there are 260 in a 264 page document. I then repeated this for the last book I read, Candide by Voltaire, and there were 507 semi colons in a 189 page book. This seems like a witch hunt.

You know I said colons right? Not semi colons :)

Re: Half a Second – a book about the XZ backdoor

#25

Post by infinite_spin »

sevg wrote: post #24
infinite_spin wrote: post #10

Earlier quoted context omitted.

I've always used a lot of semi-colons in my writing, especially in my technical writing. So I did a search on this pdf for semi colons, and there are 260 in a 264 page document. I then repeated this for the last book I read, Candide by Voltaire, and there were 507 semi colons in a 189 page book. This seems like a witch hunt.

You know I said colons right? Not semi colons :)

ah my mistake, those are a bit uncommon in my writing, I feel like they seem pretentious. i just use the semi-colons because it's closer to the way I pause, and alternate, in my thoughts.

Re: Half a Second – a book about the XZ backdoor

#26

Post by infinite_spin »

jstanley wrote: post #21
infinite_spin wrote: post #10

Earlier quoted context omitted.

I've always used a lot of semi-colons in my writing, especially in my technical writing. So I did a search on this pdf for semi colons, and there are 260 in a 264 page document. I then repeated this for the last book I read, Candide by Voltaire, and there were 507 semi colons in a 189 page book. This seems like a witch hunt.

I pasted the introduction into Pangram and it said 100% AI.

well also I read the parent's comment wrong, they just said colons, not semi-colons

Re: Half a Second – a book about the XZ backdoor

#27

Post by VladVladikoff »

OldMatey wrote: post #2

Given the time and effort that went into this, and the luck that one diligent person noticed, investigated and discovered what was going on before it could get further... it seems very likely to me that this has happened already in other libraries without being discovered.

I wonder if the nation state actors are doing people profiling on owners of important packages to find the most vulnerable for an attack.

Re: Half a Second – a book about the XZ backdoor

#28

Post by bandrami »

eth0up wrote: post #13
sevg wrote: post #8

Earlier quoted context omitted.

Yeah the (annoyingly) excessive use of colons feels like recent Claude models to me. Looks like author posted this themselves earlier, and even used Claude for the HN comment: https://news.ycombinator.com/item?id=48958457

"free book" "no paywall and nothing to buy." Might this not actually be a reasonable purpose for AI? I can tolerate the quirky style and AI signatures for something honest and free.

Why not just post the prompt you used? I have access to LLMs too.

Re: Half a Second – a book about the XZ backdoor

#29

Post by jersmtpd »

rwmj wrote: post #20
eth0up wrote: post #13

Earlier quoted context omitted.

"free book" "no paywall and nothing to buy." Might this not actually be a reasonable purpose for AI? I can tolerate the quirky style and AI signatures for something honest and free.

But prompting an AI adds nothing. Journalism is about research, interviewing the people involved, finding new facts, and then presenting that to your audience in a way they can understand. Getting an AI to write about something is just diluting the signal for future researchers.

You can have an AI help write it while still having done research yourself, they're not mutually exclusive. I'm not claiming whether he actually did that or not.

Like, for me personally, I'm terrible at writing, so I'll gladly have some AI throw together a draft, which I then verify and edit.

Re: Half a Second – a book about the XZ backdoor

#30

Post by eth0up »

jersmtpd wrote: post #29
rwmj wrote: post #20

Earlier quoted context omitted.

But prompting an AI adds nothing. Journalism is about research, interviewing the people involved, finding new facts, and then presenting that to your audience in a way they can understand. Getting an AI to write about something is just diluting the signal for future researchers.

You can have an AI help write it while still having done research yourself, they're not mutually exclusive. I'm not claiming whether he actually did that or not. Like, for me personally, I'm terrible at writing, so I'll gladly have some AI throw together a draft, which I then verify and edit.

exactly. If I am writing a free book with solid information, well, I am not writing it, because I am not writing free books -- I don't have time. But if AI can arrange my data, thoughts, perspective, and articulate it effectively, then I will let AI write the free book. If the book contains new, or previously unarticulated data and insight, then why not? But I see the very thought is hotly contested here.
Post reply on HN