21–30 of 106 posts
I just wish people would stop writing C code for libraries that consume arbitrary data.
@dang: Please add [2021] to the title.
Earlier quoted context omitted.
good thing that was in the title
Asking in seriousness: did you comment without reading the link? If so, why? I legit don't understand why people comment on things without having read them, and I would like to
Stochastic karma farming benefits from a larger N, hence posting without reading.
I'm a little unclear as to why JiaT75's github account still exists? Surely this should be nuked from orbit so that no one accidentally ends up using their shady code?
The deletion of the account would not delete commits associated with it. The commit would still contain everything potentially malicious, plus a reference to an account that would be deleted. Which is actually worse, you cant track what code a malicious actor has contributed (easily). So the correct thing to do is take away login / deactivate the account, and then start going through all contributions and check them…
And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH.
Can't we respect the project and give the people there space to work, and leave the peanut gallery commenting to reddit/hn/twitter/whatev.
Earlier quoted context omitted.
good thing that was in the title
Asking in seriousness: did you comment without reading the link? If so, why? I legit don't understand why people comment on things without having read them, and I would like to
(Not to say I always do this, but I do definitely click first into comments more often than I go straight for the article - it allows a much lower bar for what seems initially interesting, and I've read a lot more fascinating stuff (submissions and discussions) than I would have otherwise that way.)
It's kind of ridiculous how few lines of code can trigger such a huge and complex discussion about thread safety, where almost all developers involved actually aren't really certain whether or not this can be exploited. I just wish people would stop writing C code for libraries that consume arbitrary data.
GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…
@dang: Please add [2021] to the title.
I guess for those not sure of the context: The user Jia Tan added exploit code to the 'xz' tool as part of a larger deal. Wikipedia has a page on it here [1]. In this post, they are discussing some changes to print code specifically for the libarchive project, and some notable personalities in the security community chime in, including Colin Percival (Tarsnap among others) and Taviso (Google project zero among others…
> The user Jia Tan added exploit code to the 'xz' tool as part of a larger deal. Various discussions on this backdoor (in rough chronological order): * Backdoor in upstream xz/liblzma leading to SSH server compromise:† https://news.ycombinator.com/item?id=39865810 * What we know about the xz Utils backdoor that almost infected the world: https://news.ycombinator.com/item?id=39891607 * How the XZ Backdoor Works: https…
Here are parts 2 and 3 (weren't discussed on HN):
>Part 2: Assessing the Y, and How, of the XZ Utils incident (social engineering)
https://securelist.com/xz-backdoor-story-part-2-social-engin...
>Part 3: XZ backdoor. Hook analysis
https://securelist.com/xz-backdoor-part-3-hooking-ssh/113007...