Missing the whole Fedora timeline. I was emailed by "Jia Tan" between Feb 27 and Mar 27, in a partially successful attempt to get the new xz into Fedora 40 & 41. Edit: I emailed Russ with the details.
Timeline of the xz open source attack
61–70 of 482 posts
Re: Timeline of the xz open source attack
#62A "good" side effect of this for OSS maintainers going on, is that now any time an entitled user starts being too pushy or too... well, entitled, they can be given a canned response:
Are you trying to pull an xz attack on me?
Re: Timeline of the xz open source attack
#63Earlier quoted context omitted.
The Jigar Kumar nudges are so incredibly rude. I would have banned the account, but perhaps they contributed something positive as well that isn't mentioned. I wonder if it would be possible to crowdsource FOSS mailing list moderation.
There is a good chance that everyone in that thread except the original maintainer is in on the act. It's likely that all those accounts are managed by a single person or group. Targeting just one account for rudeness isn't going to help, if that's true.
It does help on the social/psychological side. If you, as an open source project maintainer, have a policy that such rudeness is not acceptable, you are much less likely to become a successful victim of a social attack like this.
Re: Timeline of the xz open source attack
#64Earlier quoted context omitted.
The Jigar Kumar nudges are so incredibly rude. I would have banned the account, but perhaps they contributed something positive as well that isn't mentioned. I wonder if it would be possible to crowdsource FOSS mailing list moderation.
There is a good chance that everyone in that thread except the original maintainer is in on the act. It's likely that all those accounts are managed by a single person or group. Targeting just one account for rudeness isn't going to help, if that's true.
Reminds me of the "no soap radio" joke. Joke being euphemism for collective gas lighting, but typically a "joke" played by kids on each other.
Play is just preparing for the same game but when stakes are higher?
Re: Timeline of the xz open source attack
#65Open Source is a real tragedy of the commons.
Everyone wants to consume it. Nobody wants to participate.
People are upset when a company like Elastic or Mongo switches to a "non open" license. But at the same time, the market doesn't leave much choice. Companies won't be incentivized to contribute to projects when they can freeload. The market actually wants vendors, it doesn't want to participate in open source. But they don't want to _pay_ for vendors.
So I think its entirely appropriate that anyone / any entity that creates "open source" to change their license, set limits, say "no", and let users be damed unless they're willing to make it financially appealing. It's literally "Without Warranty" for a reason.
Letting your passion project becoming hijacked into determining your mental health is really depressing. F' the people who can't get on board with your boundaries, etc around it. They deserve the natural consequences of their lack of support.
Re: Timeline of the xz open source attack
#66Never allow yourself to be bullied or pressured into action. As a maintainer, the more a contributor or user nags, the less likely I am to oblige.
But in this case he was getting hit by both someone willing to help and then multiple people complaining that things were taking too long. And when you yourself feel like things are taking too long then you’re probably more susceptible to all this.
Re: Timeline of the xz open source attack
#67This seems very difficult to defend against. What is a project with a single burnt-out committer to do?
The same as what the ant colonies do when one of their own gets infected by the Ophiocordyceps unilateralis fungus.
Re: Timeline of the xz open source attack
#68Open Source is a real tragedy of the commons. Everyone wants to consume it. Nobody wants to participate. People are upset when a company like Elastic or Mongo switches to a "non open" license. But at the same time, the market doesn't leave much choice. Companies won't be incentivized to contribute to projects when they can freeload. The market actually wants vendors, it doesn't want to participate in open source. But…
Yeah whatever. Closed source software is much easier to subvert, just have your agents join the company and they can push whatever they want without any external (or even internal) review.
Re: Timeline of the xz open source attack
#69Maybe one of the outcomes of this could be a culture change in FOSS towards systematically banning rude consumers in Github issues, or, just in general, a heightened community awareness making us coming down on them way harder when we see it happen.
Re: Timeline of the xz open source attack
#70I wonder, once the attacker gained commit permissions, were they able to rewrite and force push existing commits? In that case rolling back to older commits may not be a solution.
If my speculation is correct then the the exact date on which access was granted must then first be known, after that a trusted backup of the repo from before that date is needed. Ideally Lasse Collin would have a daily backup of the repo.
Although perhaps the entire repo may have to be completely audited at this point.