Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ Backdoor: Times, damned times, and scams

rheaeve.substack.com

Post reply on HN
Print view View original

151–160 of 193 posts

Re: XZ Backdoor: Times, damned times, and scams

#151

Post by mbrevda1 »

AnonHP wrote: post #143
hnthrowaway0328 wrote: post #138

Earlier quoted context omitted.

Israelis usually are off on Fridays so it doesn't match the git commit records.

Israelis are usually off from the evening of Friday (sundown) till the evening of Saturday (sundown) for Shabbat. Where did you get the idea that they’re off on Fridays during daytime? In this context, middle eastern countries with Islam as the majority religion have the day off on Fridays.

in Israel, Friday is generally not a workday (or "business day"), a la Sunday in the western world

Re: XZ Backdoor: Times, damned times, and scams

#153

Post by EasyMark »

beanjuiceII wrote: post #127
optimalsolver wrote: post #11

Poor Jia. Two whole years of work down the drain. If you're reading this Jia, remember that you miss 100% of the shots you don't take. Chin up, brother.

How is it down the drain? You know he didn't achieve his goals?

yep, maybe it was a false flag to take people's eye off the -other- backdoor lol

Re: XZ Backdoor: Times, damned times, and scams

#154

Post by evilDagmar »

lapcat wrote: post #37

> who regularly works in the early morning? Me > For a hacker, it is much more plausible to work in the afternoon and late at night c/hacker/younger person

No, stereotypes aside, hackers who code diligently tend to wrap their "actual work" schedule around their external obligations, and while the morning is generally filled with distractions like dealing with "morning people", after lunch (an on into the evening) there are generally far fewer interruptions. I can honestly get much more done with an uninterrupted four hours than I can in the entire eight office hours of random phone calls and emails coming in, and I am no longer a "young person", and I'll do some stuff at night just because I know it'll take half the time if I'm not interrupted and I've had a few hours to at least intermittently mull it over. If you're having peaceful mornings, I envy you.

Re: XZ Backdoor: Times, damned times, and scams

#155

Post by kelnos »

sneak wrote: post #104
BluSyn wrote: post #33

For years I've had `gc` in my terminal mapped to `TZ=UTC0 git commit` for exactly this reason. No need to change system times or git settings. (though perhaps a better way in global config?) It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.

I travel a lot but never change my workstation’s time zone out of PST/PDT these days. That would be a manual step and I don’t use Location Services.

Same. My phone automatically changes, and I'll manually change my watch, but when I travel, I leave my laptop in my home time zone. Part of it is I just can't be bothered, and part of it is I want an easy way to know what time it is at home without having to fiddle with a world clock.

Re: XZ Backdoor: Times, damned times, and scams

#156

Post by omoikane »

ufmace wrote: post #85

Probably worth considering here - if this was a state-sponsored attack, it's entirely possible (and exactly what I would do if I was running such a program) that there is one person or department actually writing the code and list messages etc, and another person or team who sits between that department and the internet and whose entire job is to ensure that everything that comes out from the development team takes p…

It's likely that there is a whole team behind this operation, and part of that team might include tasks such as "socially engineer XZ project to accept a maintainer of our choice."

This was suggested in a different post[1], where there seem to be newly created accounts that came out of nowhere to create a sense of urgency, which might have accelerated the maintainer role transition.

[1] https://connortumbleson.com/2024/03/31/watching-xz-unfold-fr...

via: https://news.ycombinator.com/item?id=39888854

Search for "Progress will not happen until there is new maintainer" for the relevant text.

Re: XZ Backdoor: Times, damned times, and scams

#157

Post by 1letterunixname »

fbdab103 wrote: post #134
1letterunixname wrote: post #132

Earlier quoted context omitted.

I never understood and continue to be baffled by the naïveté of FOSS people giving commit access to core projects to unknown parties. Assume they're a state actor or a crazy person, until proven otherwise.

That effectively means you cannot share commit rights with anybody. How am I supposed to vet someone as not a state actor? Any plausible test could be thwarted by a motivated individual.

Synchronous socialization and meeting their friends and fam. Not knowing people well is a vulnerability.

Re: XZ Backdoor: Times, damned times, and scams

#158

Post by delta_p_delta_x »

qsi wrote: post #123
4bpp wrote: post #94

GMT+8, the name (Mandarin/mixed-dialect first name + Hokkien surname) and most importantly the circumstance that the user was seen connecting from a likely VPN exit or hosted server in Singapore [1] are all consistent with a Singaporean identity, whether real or cover. For that reason, the opinion of [1]'s source that the name sounds fake should also be taken with some amount of salt (Mainland Chinese are not always…

In the few commits from Jia Tan that I've seen, the English parses (to me at least) idiomatically as a native speaker from either the US or UK, and I did not encounter any signs of Singaporean English. Obviously, this is a very small sample so one cannot read too much into it. Almost 10% of Singaporeans share the family name Tan. [1] [1] https://en.wikipedia.org/wiki/File:Singaporean_surnames_by_f...

> the English parses (to me at least) idiomatically as a native speaker from either the US or UK, and I did not encounter any signs of Singaporean English

Singapore is an Anglophone country. Many Singaporeans are perfectly capable of writing (idiomatic) BrE or NAmE, given the medium of instruction in Singaporean education from kindergarten to university is English. Example: me.

Re: XZ Backdoor: Times, damned times, and scams

#159

Post by hnthrowaway0328 »

AnonHP wrote: post #143
hnthrowaway0328 wrote: post #138

Earlier quoted context omitted.

Israelis usually are off on Fridays so it doesn't match the git commit records.

Israelis are usually off from the evening of Friday (sundown) till the evening of Saturday (sundown) for Shabbat. Where did you get the idea that they’re off on Fridays during daytime? In this context, middle eastern countries with Islam as the majority religion have the day off on Fridays.

I used to work for two Israeli companies and they were always off on Friday and Saturday. They start the week from Sunday.

Re: XZ Backdoor: Times, damned times, and scams

#160

Post by someotherperson »

1letterunixname wrote: post #157
fbdab103 wrote: post #134

Earlier quoted context omitted.

That effectively means you cannot share commit rights with anybody. How am I supposed to vet someone as not a state actor? Any plausible test could be thwarted by a motivated individual.

Synchronous socialization and meeting their friends and fam. Not knowing people well is a vulnerability.

A state actor is potentially the only person financially supported enough and willing to do this.

"You're in Zurich this weekend? Oh wow, me too. I'm holidaying with my wife. Let's grab lunch" as they proceed to prepare their military expense form for two business class tickets for them and their coworker

Post reply on HN