Story of XZ Backdoor [video] • Hacker News Board

Re: Story of XZ Backdoor [video]

#51

Post by badocr » Fri, Feb 27, 2026, 11:47 AM UTC

mbauman wrote: post #6

I'm still floored that Andres both found this and didn't ignore it. It's such a testament to an incredible engineer. (But also, my conspiratorially-inclined mind is quite entertained by the thought of some sort of parallel construction or tip from a TLA.)

> (But also, my conspiratorially-inclined mind is quite entertained by the thought of some sort of parallel construction or tip from a TLA.)

For sure you were/are not alone in this thinking. How fast the whole thing was exposed in decent enough details was... surprising.

Re: Story of XZ Backdoor [video]

#52

Post by sricharanbattu » Fri, Feb 27, 2026, 4:46 PM UTC

I had a question. People are claiming that the spike in time for ssh or the performance degradation is not much.

But in the video itself, they show that the actual ssh time was about 100 ms and the new time it took was about 600 ms. It is almost 6 times the actual time. I am expecting the performance of the benchmark to significantly drop with these times. And it should be obvious to see that something was wrong.

( I am taking nothing from Andres here. I think he's a brilliant engineer to actually find the root cause of this himself. He is a hero. I am just pointing that 500 ms is not something obscure time interval).

Re: Story of XZ Backdoor [video]

#53

Post by ufmace » Fri, Feb 27, 2026, 10:08 PM UTC

forinti wrote: post #2

Ireland recently created a Basic Income scheme for artists. Europe should have an equivalent scheme for programmers of important Open Source projects such as this one.

I don't think it's a money thing really. IIRC the regular XZ creator/maintainer had a regular job and enough money already, and it was more of a burnout thing from dealing with the usual hassles of OSS. Which means what it really needs is to be taken over by an actual business organization, with a team of developers and professional project managers and customer support people etc so no one person gets too burnt out and if anyone does, they have plenty of backup.

Re: Story of XZ Backdoor [video]

#54

Post by siddbudd » Sat, Feb 28, 2026, 8:31 AM UTC

dijit wrote: post #14

gosub100 wrote: post #8

Earlier quoted context omitted.

Russians don't celebrate Christmas on the 25th.

That was also what I took away when watching the video. Russians don't celebrate Christmas on the 25th (they Celebrate on January 7th), but even more than that: Russians don't celebrate Christmas the same way we do in the west. Their "Christmas" family celebrations are on New Years Eve. So if you're drawing conclusions from them not working on the 25th (which is a literal normal day in eastern europe) then signs poin…

ah, Eastern Europe is a homogeneous slop, good to know. The 25th is only celebrated as a national holiday in like 90% of Eastern European countries. Russia and Serbia celebrate it on January 7th instead, and even that is only due to their use of the old Julian calendar. But sure, normal day in a very narrow and obscure definition of Eastern Europe.

Re: Story of XZ Backdoor [video]

#55

Post by dijit » Sat, Feb 28, 2026, 8:33 AM UTC

siddbudd wrote: post #54

dijit wrote: post #14

Earlier quoted context omitted.

That was also what I took away when watching the video. Russians don't celebrate Christmas on the 25th (they Celebrate on January 7th), but even more than that: Russians don't celebrate Christmas the same way we do in the west. Their "Christmas" family celebrations are on New Years Eve. So if you're drawing conclusions from them not working on the 25th (which is a literal normal day in eastern europe) then signs poin…

ah, Eastern Europe is a homogeneous slop, good to know. The 25th is only celebrated as a national holiday in like 90% of Eastern European countries. Russia and Serbia celebrate it on January 7th instead, and even that is only due to their use of the old Julian calendar. But sure, normal day in a very narrow and obscure definition of Eastern Europe.

Calm your tits, it’s pretty clear I meant slavic nations, and yes: even the January 7th stuff is not celebrated like we do in the west.

I’m trying to convey to people why its materially a red-herring that “russians” wouldn’t work on the 25th: since its a normal day.