Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Timeline of the xz open source attack

research.swtch.com

Post reply on HN
Print view View original

171–180 of 482 posts

Re: Timeline of the xz open source attack

#171

Post by pixl97 »

sigmar wrote: post #137
lukaslalinsky wrote: post #63

Earlier quoted context omitted.

It does help on the social/psychological side. If you, as an open source project maintainer, have a policy that such rudeness is not acceptable, you are much less likely to become a successful victim of a social attack like this.

That would be true if you could ban the person from using new emails, but I don't think that's true when the thread if rife with sock puppet accounts. You ban the first rude email account, then there will be 2 new accounts complaining about both the lack of commits and the "heavy-handed mailing-list moderation" stifling differing views.

Yep, as the attacker you bias the entire playing field to your side. If a mailing list has 20 or so users on it, you create 50 accounts over time that are nice, helpful, and set a good tone. Then later you come in with your attack and the pushy assholes. Suddenly those 50 puppets just slightly side with the asshole. Most people break under that kind of social pressure and cave to the jerks request.

Re: Timeline of the xz open source attack

#172

Post by jethro_tell »

dylan604 wrote: post #161
phicoh wrote: post #94

Earlier quoted context omitted.

I think a problem is that there doesn't seem any way to automatically check this. If we assume that anything that is used during build time can be malicious then figuring out those dependencies is already hard enough. Mapping that to organizational stability is one step further.

This is where the but FOSS is reviewable so it is trusted falls down. This situation is a prime example of how that fallacy is misconstrued. By being FOSS didn't make it trustworthy, it just meant that people had a fighting chance to find out why when something does happen. That's closing the barn door after the horses already left. I'm not knocking FOSS at all. I just think some people have the concept twisted. Just…

You don't think every nation state has people inside private software shops? Especially big tech?

Look at stuff getting signed with MS keys, hardware vendors with possible backdoors.

Social engineering is social engineering and it can happen anywhere no matter the profit motivation or lack there of.

Money interest in software won't save you any more than Foss.

Re: Timeline of the xz open source attack

#173

Post by Filligree »

jrochkind1 wrote: post #169
nrawe wrote: post #78

"It's also good to keep in mind that this is an unpaid hobby project." ~ Lasse Collin, 2022-06-08. As someone working in security, the fact that _foundational_ pieces of the computing/networking rely on motivated individuals and essentially goodwill is mind blowing. There are great aspects to the FOSS movement, but the risks – particularly the social engineering aspects as demonstrated here – and potential blast radi…

What it reminds me of, is my reoccuring thought, not just about open source but including this aspect, that we've built up a society based on software, that we could literally only afford because we've done it unsustainably. The economy could not bear the costs of producing all this software in an actual reliable sustainable way. So... now what.

Could it really not afford it? I’m not convinced that is the case, so much as we don’t have a way to pay people for their effort.

Re: Timeline of the xz open source attack

#174

Post by pixl97 »

soraminazuki wrote: post #102
tommiegannert wrote: post #29

Earlier quoted context omitted.

The Jigar Kumar nudges are so incredibly rude. I would have banned the account, but perhaps they contributed something positive as well that isn't mentioned. I wonder if it would be possible to crowdsource FOSS mailing list moderation.

Not surprising, unfortunately. You'd think malicious actors would be nice to people they're trying to deceive. But after watching a few Kitboga videos, I learned that they more often yell, abuse, and swear at their victims instead.

Being nice gives people time to think.

Being mean is stressful and stops your brain from working properly. If someone doesn't allow you to be abusive, then they are not a mark. Predators look for prey that falls into certain patterns.

Re: Timeline of the xz open source attack

#175

Post by ceejayoz »

Fnoord wrote: post #143
ceejayoz wrote: post #75

Earlier quoted context omitted.

Ah, the old "undercover cops can't lie about not being a cop, just ask them" technique.

If you casually ask this while you can study (and preferably record!) the person's posture and they react in real-time then you can apply interrogation technique which CIA et al use.

So becoming an open source maintainer will involve an in-person trip to an interrogation?

The xz attack involves, in significant part, a maintainer burned out and happy to accept offered help. I don't think making it substantially harder to receive genuine help is likely to improve the situation.

Re: Timeline of the xz open source attack

#176

Post by mschuster91 »

jrochkind1 wrote: post #169
nrawe wrote: post #78

"It's also good to keep in mind that this is an unpaid hobby project." ~ Lasse Collin, 2022-06-08. As someone working in security, the fact that _foundational_ pieces of the computing/networking rely on motivated individuals and essentially goodwill is mind blowing. There are great aspects to the FOSS movement, but the risks – particularly the social engineering aspects as demonstrated here – and potential blast radi…

What it reminds me of, is my reoccuring thought, not just about open source but including this aspect, that we've built up a society based on software, that we could literally only afford because we've done it unsustainably. The economy could not bear the costs of producing all this software in an actual reliable sustainable way. So... now what.

It might be a good idea for governments to coordinate with computing advocacy groups/associations (e.g. German CCC, NANOG, popular Linux distributions such as Ubuntu, Debian, Fedora, Arch)... set up a fund of maybe 10 million euros, have the associations identify critical, shared components, and work out funding with their core developers. 10M a year should fund anything from 100-200 developers (assuming European wages), that should be more than enough, and it's pocket change for the G20 nations.

If that's too much bureaucracy or people fear that governments might exert undue influence: hand the money to universities, go back to the roots - many (F)OSS projects started out in universities after all. Only issue there is that projects may end up like OpenStack in the end ;)

Re: Timeline of the xz open source attack

#177

Post by itslennysfault »

rwmj wrote: post #61

Missing the whole Fedora timeline. I was emailed by "Jia Tan" between Feb 27 and Mar 27, in a partially successful attempt to get the new xz into Fedora 40 & 41. Edit: I emailed Russ with the details.

I wondered about this. I saw the note at the bottom "RedHat announces that the backdoored xz shipped in Fedora Rawhide and Fedora Linux 40 beta" but saw nothing in the timeline explaining when/how it made it into Fedora.

Re: Timeline of the xz open source attack

#178

Post by djvdq »

nrawe wrote: post #78

"It's also good to keep in mind that this is an unpaid hobby project." ~ Lasse Collin, 2022-06-08. As someone working in security, the fact that _foundational_ pieces of the computing/networking rely on motivated individuals and essentially goodwill is mind blowing. There are great aspects to the FOSS movement, but the risks – particularly the social engineering aspects as demonstrated here – and potential blast radi…

Nothing will really change, sadly. Remember log4j? There were also a lot of talking why people working on FOSS should be paid. And after one month almost no one remembered these voices exept for small minority of people.

Re: Timeline of the xz open source attack

#179

Post by squigz »

cesarb wrote: post #154
jddil wrote: post #121

Earlier quoted context omitted.

Never understood why our industry seems unique in our willingness to do unpaid work for giant corps. Your compression library isn't saving the world, it's making it easier for amazon to save a few bucks. You have the right to be paid for your time. It's valuable. I enjoy coding too... but the only free coding I do is for myself. Use a proper license, charge for your time and stop killing yourself doing unpaid hobby p…

> Never understood why our industry seems unique in our willingness to do unpaid work for giant corps. Your compression library isn't saving the world, it's making it easier for amazon to save a few bucks. The work was not being done "for giant corps"; it was being done for everyone, and giant corps just happen to be a part of "everyone", together with small corps, individual people, government, and so on. > You have…

Weird that this is a concept people struggle to understand...

Re: Timeline of the xz open source attack

#180

Post by [deleted] »

kevindamm wrote: post #46
rsc wrote: post #32

Earlier quoted context omitted.

"unauthenticated remote code execution" is a fairly standard term for this kind of access. ( https://www.google.com/search?q=%22unauthenticated+remote+co... )

Fairly standard term for a kind of access similar to this, but the distinction is important. Consider the impact if anybody else, not just this attacker, could have exploited it -- on the other hand, it may have been discovered sooner (had it also not been discovered by accident first).

[deleted]
Post reply on HN