Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we know about the xz Utils backdoor that almost infected the world

arstechnica.com

Post reply on HN
Print view View original

331–336 of 336 posts

Re: What we know about the xz Utils backdoor that almost infected the world

#331

Post by account42 »

jcranmer wrote: post #227
nextaccountic wrote: post #210

Earlier quoted context omitted.

Why is it safer?

It means the libraries are only loaded when they are needed, so if you never use the (e.g.) xz compression feature, the xz library will not be loaded, and a backdoor added in the xz library simply can't trigger. (Another side note is this may change the initialization order of libraries--so the initialization functions of an xz library don't run until xz is first used, and this may fail to let you intercept the ssh r…

> this may fail to let you intercept the ssh routines in time

It only makes it harder since you can always patch the code of the entire process at runtime (remapping things writable as needed).

Re: What we know about the xz Utils backdoor that almost infected the world

#332

Post by account42 »

mardifoufs wrote: post #253
markus_zhang wrote: post #170

Earlier quoted context omitted.

I hope Open Source maintainers and the big companies get the message -- they need to change the financial outlook of open source maintaining.

The original xz maintainer stated that he delegated maintenance due to (then) current mental illness issues he was facing, not because of finances.

He mentioned mental illness and other issues. Those other issues could very well be financial. Financial issues also affect mental health.

Re: What we know about the xz Utils backdoor that almost infected the world

#333

Post by account42 »

slowmovintarget wrote: post #281
markus_zhang wrote: post #177

Earlier quoted context omitted.

This might solve the original author's issues, AND might also attract other people to do the job. The more people, the more eyes. It's definitely not a silver bullet, but I would be surprised that OSS maintainers are fine with the current financial arrangement, or lack of it.

Money itself doesn't necessarily cure mental health issues. I'm mean it usually doesn't hurt, but it's not like you can blend cash up into a smoothy and cure depression. (Yes, that's a South Park reference.)

Lack of money on the other hand can both cause mental issues and make dealing with them harder if not impossible.

Re: What we know about the xz Utils backdoor that almost infected the world

#334

Post by account42 »

CaptainOfCoit wrote: post #83
mapasj wrote: post #11

I’m guessing the original maintainer of xz handed responsibilities to Jia Tan without ever seeing him/her or at least sharing a phone call. Is that common to only communicate only through email/github? I guess some maintainers of open source projects will be more cautious after this story.

> Is that common to only communicate only through email/github? Absolutely. I've both taken over libraries as a maintainer and given away the responsibility of maintaining a library after only communicating via text, and having no idea who the "real" person is. > I guess some maintainers of open source projects will be more cautious after this story. Which is completely the wrong takeaway. It's not the maintainer who…

Trusting the maintainer als means trusting that they won't hand over the project to someone untrustworthy. It is the maintainers responsibility to honor that trust if they want their software to be used in the first place.

Re: What we know about the xz Utils backdoor that almost infected the world

#335

Post by account42 »

dralley wrote: post #277
netol wrote: post #47

Earlier quoted context omitted.

It is unfortunate that Lasse Collin has been silent about what he knows about him

Can we not dogpile Lasse after his vacation was ruined by this. He has much bigger concerns right now than trying to export and sanitize his entire communication history with Jia.

Lamenting the lack of public information is a far cry from dogpiling on the guy.

Re: What we know about the xz Utils backdoor that almost infected the world

#336

Post by actionfromafar »

josephg wrote: post #279
turol wrote: post #57

Earlier quoted context omitted.

https://xkcd.com/927/

I think that would land harder if configure / automake / autoconf were actually a standard. And not, you know, a bunch of cobbled together shell scripts that generate other shell scripts.

It quacks pretty much like a standard though.
Post reply on HN