Andres Freund and the xz backdoor
nytimes.com
Andres Freund and the xz backdoor
1–10 of 28 posts
Re: Andres Freund and the xz backdoor
#2Re: Andres Freund and the xz backdoor
#3"Engineers have been circulating an old, famous-among-programmers web comic about how all modern digital infrastructure rests on a project maintained by some random guy in Nebraska. (In their telling, Mr. Freund is the random guy from Nebraska.)"
No, it's Lasse Collin the _maintainer_ of xz..
Re: Andres Freund and the xz backdoor
#4> Engineers have been circulating an old, famous-among-programmers web comic about how all modern digital infrastructure rests on a project maintained by some random guy in Nebraska. (In their telling, Mr. Freund is the random guy from Nebraska.)
Huh, my take was that the "guy in Nebraska" was Lasse Collin, the original xz maintainer. Am I alone in that?
Re: Andres Freund and the xz backdoor
#5In an otherwise well written and accessible article, I found the naming of example nations gratuitous:
> some researchers believe only a nation with formidable hacking chops, such as Russia or China, could have attempted it.
… or the US, UK, Israel, Germany, France, Canada, Australia, DPRK, Japan, etc, and the security offence companies that work as a supply chain for such nations in provision of embedded exploits.
It’s based on very weak logic, but perhaps “Jia Tan” rules out China.
Re: Andres Freund and the xz backdoor
#6> Engineers have been circulating an old, famous-among-programmers web comic about how all modern digital infrastructure rests on a project maintained by some random guy in Nebraska. (In their telling, Mr. Freund is the random guy from Nebraska.) Huh, my take was that the "guy in Nebraska" was Lasse Collin, the original xz maintainer. Am I alone in that?
Just made exactly the same comment, the xz maintainer is clearly the proverbial "random guy in Nebraska"
Re: Andres Freund and the xz backdoor
#7> Engineers have been circulating an old, famous-among-programmers web comic about how all modern digital infrastructure rests on a project maintained by some random guy in Nebraska. (In their telling, Mr. Freund is the random guy from Nebraska.) Huh, my take was that the "guy in Nebraska" was Lasse Collin, the original xz maintainer. Am I alone in that?
That would definitely be a more accurate/literal interpretation of what the xkcd comic meant.
But I think this holds up in the spirit of it, which is that core open source contributors / maintainers keep things afloat despite a shocking lack of resources or investment by the companies that benefit from it. (Notwithstanding the fact that Freund is employed by Microsoft.)
Re: Andres Freund and the xz backdoor
#8In an otherwise well written and accessible article, I found the naming of example nations gratuitous: > some researchers believe only a nation with formidable hacking chops, such as Russia or China, could have attempted it. … or the US, UK, Israel, Germany, France, Canada, Australia, DPRK, Japan, etc, and the security offence companies that work as a supply chain for such nations in provision of embedded exploits. I…
Between that and wrongly calling Andres Freund (the hero who saved the day) the Nebraska Man, I'm inclined to believe Jia Tan is American and the NYT was ordered to push narratives to deflect attention away.
Re: Andres Freund and the xz backdoor
#9> Engineers have been circulating an old, famous-among-programmers web comic about how all modern digital infrastructure rests on a project maintained by some random guy in Nebraska. (In their telling, Mr. Freund is the random guy from Nebraska.) Huh, my take was that the "guy in Nebraska" was Lasse Collin, the original xz maintainer. Am I alone in that?
Same, possibly a mix up on their part
Re: Andres Freund and the xz backdoor
#10A more level-headed report with less fluff from the economist: https://www.economist.com/science-and-technology/2024/04/02/...