Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ Backdoor: Times, damned times, and scams

rheaeve.substack.com

Post reply on HN
Print view View original

61–70 of 193 posts

Re: XZ Backdoor: Times, damned times, and scams

#61

Post by pvg »

willsmith72 wrote: post #38
thrdbndndn wrote: post #24

I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…

how is it tasteless? the only fact is that, almost always, Jia Tan's timezone was UTC+8. the rest is mostly speculation about where else they could have been from given holidays and times

The whole enterprise is a little tasteless with a chance of worse. Not some substacker or tweeter speculating in itself - people are obviously free to let their speculation flag fly. But you start amplifying this stuff on an open internet messageboard and next thing you know, it's reddit 'found' the Boston bomber. The local downsides outweigh the gawking value and I say this as a dyed-in-the-wool internet gawker.

Re: XZ Backdoor: Times, damned times, and scams

#62

Post by ShamelessC »

thrdbndndn wrote: post #24

I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…

> understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't

People who don’t read the article and find themselves lacking an informed or nuanced understanding of the contents of said article are the only ones to blame here. Full stop.

That HN doesn’t have a culture of shaming those who don’t read the article is partly the fault of the rules here which finds “read the article please” to be a distraction/nuisance but don’t mind that this often results in misinformed discussion propagating toward the top of a thread.

Re: XZ Backdoor: Times, damned times, and scams

#63

Post by krick »

chgs wrote: post #54
mik1998 wrote: post #32

I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.

Not sure why you’re downvoted. When you think of state actors, Israel comes very high (stuxnet etc), as well as the usual US/Russia/China/NK groups. Unit 8200 in the IDF especially have a very notable reputation. That’s not to say other counties don’t have capabilities (and this doesn’t look like you need the resources of a group like say the NSA or GCHQ for this particular attack - indeed it could just be a single l…

If the only think I knew was UTC+2 (and I don't even think I know that, I'm really cautious with assumptions about what mistakes that kind of people plausibly make), Israel would be very high on the list. But FWIW, 25Dec is a Catholic holiday, and even though it's mentioned on Wikipedia page about Israel holidays, I'm not sure how official that is. I mean, it doesn't seems to be, like, a real Israeli holiday.

Re: XZ Backdoor: Times, damned times, and scams

#65

Post by wannacboatmovie »

Everyone here is acting as if it's impossible to script git commits or email replies as a scheduled task or even put someone on the night shift to click send - to give the appearance of being somewhere you're not.

There was WAY more than one person involved here. Every email, commit, etc. was a deliberate task that was carefully planned.

Re: XZ Backdoor: Times, damned times, and scams

#67

Post by rvba »

tete wrote: post #51

What if it is an American (random other place) pretending to be an Eastern European pretending to be Chinese? ;) If I would be pretending something I'd certainly put at least one more indirection in.

Or a Chinese pretending to be an eastern european or israeli pretending to be a chinese?

In such setup nothing bad happens in such a leak.

Re: XZ Backdoor: Times, damned times, and scams

#68

Post by FredFS456 »

cft wrote: post #45
gpm wrote: post #8

Earlier quoted context omitted.

They probably have/will, though we are unlikely to find out what they get unless they manage to arrest/charge/try him. Jia Tan probably used a vpn though - we know that they did for accessing IRC (source: https://boehs.org/node/everything-i-know-about-the-xz-backdo... )

Most (but not all ) VPN providers keep logs and payment info that are subpoenable. You could use something like Mulvad with Lightning Network payments, but I am not sure that even that is fully anonymous. The Witopia VPN that he used for IRC [1] is US based: https://www.personalvpn.com/contact-us/ and they don't mention neither LN payments nor not keeping logs. 1. "~jiatan@185.128.24.163" https://boehs.org/node/every…

Mullvad accepts cash in an envelope with no return address, good luck tracing that

Re: XZ Backdoor: Times, damned times, and scams

#69

Post by alisonatwork »

chgs wrote: post #49
s_Hogg wrote: post #44

Saying "Eastern Europe" as opposed to "Moscow" is a little coy, isn't it? They're in the same time zone and one seems likelier than the other, to put it one way. Edit: speaking of, these guys might also have some time pressure at the moment with regards to hacking stuff lol. Kind of fits the bill with what we know about the hack

Moscow is UTC+3 year round, not UTC+2 in winter and +3 in summer

Israel is perhaps more likely given daylight savings.

Re: XZ Backdoor: Times, damned times, and scams

#70

Post by lucb1e »

lapcat wrote: post #37

> who regularly works in the early morning? Me > For a hacker, it is much more plausible to work in the afternoon and late at night c/hacker/younger person

> c/hacker/younger person

What is this syntax? I know s/a/b/ for sed substitution but not such a thing starting with c

Post reply on HN