Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reflections on Distrusting xz

joeyh.name

Post reply on HN
Print view View original

211–220 of 335 posts

Re: Reflections on Distrusting xz

#211

Post by justinsaccount »

loftsy wrote: post #86

I took a look at the diff linked in the article with code that "we are all running". The top of the diff certainly looks interesting. They remove the bounds check in dict_put() and add a safe version dict_put_safe(). This kind of change is difficult to make without mistakes because it silently changes the assumptions made when code calling dict_put() was originally written. ALL call sites would need to be audited to…

Also because the 'safe' version only checks

  dict->pos == dict->limit
and not

  dict->pos >= dict->limit
if you can get one call of dict_put somewhere to pass the limit, all later calls of dict_put_safe will happily overwrite memory and not actually be safe.

Re: Reflections on Distrusting xz

#212

Post by tomn »

ghaff wrote: post #161
tomn wrote: post #137

Earlier quoted context omitted.

Yeah, it's not enforced (and certainly not with linked-in and facebook) but it's really not uncommon to require use of real names for contributions. Linux doesn't allow anonymous contributions: https://www.kernel.org/doc/html/latest/process/submitting-pa... and this guide has been adopted by a lot of GPL-licensed projects (at least openwrt, glibc and gcc).

I'm not sure why the downvotes. That seems to be a statement of fact. You can do a certain amount of identity obfuscation online but for anyone with a real professional profile you're generally not really anonymous if anyone really cares to find out your true name.

Me neither, i even provided a source, and it's easy to find other examples. There certainly are projects that allow anonymous contributions, but i doubt it's the majority of projects that one would consider important.

For these kinds of projects you could make up an identity relatively easily and nobody would know, but you're screwing over the project (as they may need to remove your contributions if they find out), so it's not something to be doing if you actually want to contribute (instead of inserting backdoors).

The original idea (not being able to contribute without a verified identity) is still wrong, but it's wrong because it's impractical to prove identity in a way that people find acceptable (and works), not because people will not give up anonymity, as many of the replies state.

Re: Reflections on Distrusting xz

#213

Post by fl7305 »

The_Colonel wrote: post #136
Lichtso wrote: post #72

Earlier quoted context omitted.

Yes and no. A local GIT repo can be changed (including its history) however you please. But once you have shared it with others you can't take that back. If you try to, then others will notice that the hashes mismatch and that their HEAD diffs uncleanly. I know the term is infamous here, but GIT is essentially a blockchain. Each commit has a hash, which is based on the hashes of previous commits, forming a linked lis…

> If you try to, then others will notice that the hashes mismatch and that their HEAD diffs uncleanly. So it relies on a human noticing and acting upon it. People not noticing backdoors being merged into the project is kinda the source of this problem.

You can automate checks for if a large part of the previous git history suddenly changed.

You can't automate checks for malicious code.

Re: Reflections on Distrusting xz

#214

Post by nottorp »

executesorder66 wrote: post #177
nottorp wrote: post #162

Earlier quoted context omitted.

> I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing The age of self censorship :) I don't post anything on my FB. I'd still reject any employer who wanted to take a look.

>> what's on it is no one's -ing business in a professional context. > The age of self censorship :) I find this amusing. I would also like to know what you hoped to achieve by self censoring the word fucking in your message above. - HN doesn't block posts with any kind of "profanity" filter - You didn't spare anyone from the profanity, since we all knew exactly what you were saying/thinking So I'm really curious wha…

That one amuses me because of a character in a (iirc) fantasy book that swore all the time but used just -ing everywhere. Sadly I don’t remember what character of which book…

Re: Reflections on Distrusting xz

#215

Post by strogonoff »

aleph_minus_one wrote: post #209
strogonoff wrote: post #128

Earlier quoted context omitted.

I believe the problem of thankless maintenance is best solved with two things: the thanks (yes, we are all human and want recognition and appreciation from fellow humans)[0], and a stable employment (work for a good large business while open-sourcing what’s possible)[1]. If you do OSS for profit, then it can become a question of where is more money; but if you work a reliable job with insurance, relationships and oth…

> and a stable employment (work for a good large business while open-sourcing what’s possible) Even if it was hypothetically possible to open-source basically everything that the team in which I work produces: The software that I work on is very specialized software that is used by the company's employees and customers for specialized purposes. Imagine some nice LoB application that is actually somewhat comfortable t…

> The software that I work on is very specialized software that is used by the company's employees and customers for specialized purposes

Oh really? Welcome to the club. Our very specialized software for very specialized purposes used Django with a certain auth provider. So I refactored that into a standalone Django app that painlessly handles this specific OAuth provider, configurable via settings with sane defaults, and open-sourced it. (The refactoring was very beneficial to myself, that part of the project got instantly nicer to work with.)

Of course, it is small beans compared to something algorithmically hardcore (I was a junior myself back then), but it’s just an example.

Any software, no matter how specialized and bespoke, can be expressed as many self-contained isolated components that individually know nothing about that specialization and bespokeness. In fact, such factoring is generally a sign of good design: you may have heard of the loose coupling & high cohesion principle—once you follow it, open-sourcing a particular component is very straightforward.

Note, though, that if your contract has certain licensing provisions in certain countries you may not be allowed to unilaterally open-source anything during the full term of employment (even if it is unrelated to your dayjob). You may need to get approval first. However, many good tech companies are reasonable when it comes to open-sourcing non-core components.

Re: Reflections on Distrusting xz

#216

Post by Y_Y »

stavros wrote: post #197
Y_Y wrote: post #155

Earlier quoted context omitted.

I'll bite. Wales is a country only in a "traditional" sense, since it does not currently hold the type of sovereignty we require of "countries" in the usual sense. As Voltaire said, "This body which called itself and which still calls itself the Holy Roman Empire was in no way holy, nor Roman, nor an empire.". Wales, when independent, could reasonably be described as a nation state, being roughly associated with the…

Are there any actual nation states? Even small countries, like Greece, contain other nationalities.

Greece is certainly a nation state, being primarily occupied by "Greeks" (referring the the nebulous concept of a national identity). It doesn't matter if some French or Turks live there.

A country that strictly limited residency by ethnic identity might be called an "ethnostate" and indeed it's hard to find a pure example of one of those.

Re: Reflections on Distrusting xz

#217

Post by jannes »

constantcrying wrote: post #62
irdc wrote: post #8

One thing that comes to mind is that “Jia Tan” might be more accurately seen as a “sleeper” of some sort: a foot soldier who infiltrates a juicy open source project and waits for further instructions; backdooring sshd might not have been part of the original plan. Which raises the concerning question of how much more sleeper maintainers there are.

>Which raises the concerning question of how much more sleeper maintainers there are. Given how easy the infiltration is and how extremely hard to detect it is, likely a lot. For an intelligence operation it is also extremely cheap, you just need a few knowledgeable developers spending some time each week on the project. The upside being a backdoor into a significant portion of infrastructure, the downside being wast…

At this point I wouldn’t be surprised if the NSA also has a couple of Microsoft employees on their payroll.

Re: Reflections on Distrusting xz

#218

Post by sergioisidoro »

It's a bit ironic that after a trust attack this person ends the article sayin

> I do have a xz-unscathed fork which I've carefully constructed to avoid all "Jia Tan" involved commits.

He may be fully legitimate, and perhaps a famous person in OSS (which I was unfamiliar with), but still ironic :)

Re: Reflections on Distrusting xz

#219

Post by lenerdenator »

cletus wrote: post #170

The US spends $30-60 billion a year on agriculture and subisides [1]. This is controversial for all the obvious reasons. Without subsidies we'd waste less food but overproduction of food is an intentional objective of these programs. Why? Because if there's a major drought or crops are lost to ice or snow or flooding, Americans won't starve. It's why we have things like the US government having a reserve of over a bi…

Doesn't .gov do a bit of that already?

Part of the problem is, no one knows who's really working on what. If you asked some of the most knowledgeable people in the GNU/Linux ecosystem who maintained xz before last week, there's a real chance they couldn't have told you, not without some investigating first. And that would only have gotten them a name, not the maintainer's personality, resources situation, etc.

There needs to be a census of sorts over the stuff that goes into the GNU/Linux ecosystem to see who needs what.

Re: Reflections on Distrusting xz

#220

Post by lenerdenator »

irdc wrote: post #192
chjj wrote: post #179

Earlier quoted context omitted.

I'm not sure why people keep misidentifying the problem as "lack of funding". Lasse Collin was doing fine as a maintainer up until Jia Tan showed up. He was psy-op'd into believing there was a crowd of angry people eagerly awaiting a new release when there wasn't. No real person was unhappy with the way he'd been maintaining xz.

Getting help for mental health issues is a whole lot easier if you have the money.

IIRC the xz package was maintained by an individual in a place with at least some socialized healthcare, but correct me if I'm wrong (I'm not trying to be snarky here, please do).
Post reply on HN