Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xz: A microcosm of the interactions in open source projects

robmensching.com

Post reply on HN
Print view View original

171–180 of 353 posts

Re: Xz: A microcosm of the interactions in open source projects

#171

Post by lrvick »

rafpin wrote: post #165

Would ssh servers with port knocking set up be safe from this backdoor? I'm not sure I got it correctly, but seems the RCE can only be performed after connecting to the ssh server, but if the port is hidden behind a reasonable sequence of tcp/udp knocks, then it won't happen? I've been using port knocking on ssh servers, and it definitely does not replace proper ssh configuration, but so far seems like a cheap extra…

I do not use or recommend security through obscurity.

Such things can always be automatically discovered.

https://github.com/eliemoutran/KnockIt

Any effort spent on setups like this is likely better spent removing the need for having ssh at all by moving to immutable appliance distros be they specialized like homeassistant or general purpose like TalosOS.

Re: Xz: A microcosm of the interactions in open source projects

#172

Post by jasoneckert »

kimixa wrote: post #31

I do sometimes wonder if by trying to be "nice" to users and try to see the best intentions of commenters, many developers waste huge amounts of mental energy. For context, I've really only worked on "fun" side projects, namely emulators and game remakes, where I've explicitly avoided any mention of donations or similar. Both as it's intended to be a distraction from my job, not become part of it. And generally avoid…

I'm always surprised at how much developers and maintainers will willingly put up with. For example, if you visit the Matrix feed for the Asahi Linux project, you'll see hoards of trolls and time-wasters that are regularly engaged by Asahi team members who are giving them the benefit of the doubt, when they really should be removing those posts without comment or acknowledgement.

I believe this masochistic behaviour stems from a combination of both general optimism and dedication to a particular cause. The more that developers are passionate about what they are doing, the more they are willing to engage with the peanut gallery.

Re: Xz: A microcosm of the interactions in open source projects

#173

Post by AnonymousPlanet »

ginko wrote: post #166
AnonymousPlanet wrote: post #158

Earlier quoted context omitted.

Since we're reading tea leaves: They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann. This could be a cultural oversight on the attacker's side, which points towards any culture that has a wide spread belief t…

>They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann. Jansen is a Danish/Norwegian surname and Hans is still fairly popular in Denmark. https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-i-...

Interesting. Jansen is pretty common in Germany aswell. How old would a typical Danish Hans be? From what I can see in [1], Hans hasn't been a popular baby name for decades in Denmark either.

Edit: Another country that seems to have retained popularity for "Hans" for a longer time than Germany is the Netherlands. According to [2], its popularity seems to have gone down significantly as well, with a further sharp dropoff in the 90s.

There are plenty of other names to choose from if you want to create a fake personality. It's curious they chose one that sticks out among the age cohorts you would expect participating on Github.

[1] https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-ti...

[2] https://www.babynamen.nl/naam/hans/

Re: Xz: A microcosm of the interactions in open source projects

#174

Post by rini17 »

aborsy wrote: post #12
SuperHeavy256 wrote: post #10

So the first step of this huge mess was: a social engineering attack. Attacking a tired, burnt-out open source project developer and peer pressuring him into giving more control of the repo to the attacker.

Enabled by customers who don’t pay or donate.

On the other hand, accepting significant amounts of money causes overhead (accounting, taxation). Plus it reinforces the psychological obligation and it's not fun anymore. Thus many maintainers avoid it.

Re: Xz: A microcosm of the interactions in open source projects

#175

Post by silverquiet »

tkiolp4 wrote: post #97

If I were a chinese hacker trying to do something evil, why on earth would I use a chinese handler/username? Wouldn’t it be better to use an English/European name to gain (even more) trust from open source maintainers? On the other hand, if I were a non-chinese hacker trying to do evil, then using a chinese handler does make more sense (China is evil, blah blah blah)

Seeing an Asian (any part of Asia) name wouldn’t give me any pause in the slightest. I don’t want to start anything here, but aren’t they disproportionately represented in the American software industry as compared to their percentage of the population?

What would raise my hackles would be someone with a name that codes western who had grammatical idiosyncrasies common to ESL Asians.

Re: Xz: A microcosm of the interactions in open source projects

#176

Post by jpz »

I think the idea this was HUMINT operation by a state sponsored intelligence service is more likely.

The twitter thread here was interesting.

https://x.com/thegrugq/status/1774392858101039419

Raging about these being inconsiderate people, when they were likely fictional personalities that were part of a long con seems to be a bit foolish to me.

Re: Xz: A microcosm of the interactions in open source projects

#177

Post by est »

lrvick wrote: post #171
rafpin wrote: post #165

Would ssh servers with port knocking set up be safe from this backdoor? I'm not sure I got it correctly, but seems the RCE can only be performed after connecting to the ssh server, but if the port is hidden behind a reasonable sequence of tcp/udp knocks, then it won't happen? I've been using port knocking on ssh servers, and it definitely does not replace proper ssh configuration, but so far seems like a cheap extra…

I do not use or recommend security through obscurity. Such things can always be automatically discovered. https://github.com/eliemoutran/KnockIt Any effort spent on setups like this is likely better spent removing the need for having ssh at all by moving to immutable appliance distros be they specialized like homeassistant or general purpose like TalosOS.

> security through obscurity

This is not obscurity, as someone said on HN earlier, good security is good armor, good port knocking is camouflage. They are both important.

Re: Xz: A microcosm of the interactions in open source projects

#178

Post by EasyMark »

Saying that it's a microcosm for "open source" is a bit hyperbolic. What would be more accurate is saying that it's a microcosm of "there is a certain set of users to be ignored" when writing open source software. One has to learn to develop a thick skin and guilt free ignoring of those who don't contribute anything to a project such as constructive suggestions, bug reports, or actual code.

Re: Xz: A microcosm of the interactions in open source projects

#179

Post by lrvick »

nuc1e0n wrote: post #157

My take away from this is that people are still far too blasé about introducing hard dependencies and complexity, even after the left-pad incident as a warning. OpenSSH is a massive wall of code. Such complex systems are inherently untrustworthy to me, no matter what language they might be written in. Even with ernest devs there are still more opportunities for mistakes.

Agreed, which is why IMO ssh in production is a terrible idea that reveals even worse problems.

A server with ssh generally implies there is a shell, and cli tools, and an administration model that involves humans connecting to servers to manually update them in place like pets.

Having a full workstation-optimized distro like ubuntu or debian with hundreds of packages constantly shifting and updating as a critical production server is wildly high risk in terms of both reliability and security.

I understand this is how most sysadmins were taught but it is a 70s unix mainframe mindset from a time before security was a thing and everyone on the internet was a good actor.

Only a workstation or dev server should have tools for humans like ssh installed.

Production servers should be hardened immutable appliance kernels with read only root filesystems that verify and run signed containers, or run a tiny shim init system in a couple hundred lines that spawns a single application specific binary you trust.

No production systems I launch today even have xz installed, or a package manager, or a shell.

Re: Xz: A microcosm of the interactions in open source projects

#180

Post by withinboredom »

figassis wrote: post #109
kimixa wrote: post #31

I do sometimes wonder if by trying to be "nice" to users and try to see the best intentions of commenters, many developers waste huge amounts of mental energy. For context, I've really only worked on "fun" side projects, namely emulators and game remakes, where I've explicitly avoided any mention of donations or similar. Both as it's intended to be a distraction from my job, not become part of it. And generally avoid…

Usually, I try to use projects in languages I work with so if the issue is not important enough for me to make a PR, then it’s not important enough. One thing I wish were possible is to sponsor an issue. I don’t usually sponsor open source projects, but I would likely sponsor a lot of issues just to speed up resolution. I think this could move a lot of projects in the right direction. Depending on difficulty, the mai…

As long as that money is held in escrow. Otherwise vaporware would make a killing.
Post reply on HN