The Git repositories of XZ projects are available on GitHub again

#1

Post by stux » Tue, Apr 09, 2024, 10:52 PM UTC

The Git repositories of XZ projects are available on GitHub again
github.com

Re: The Git repositories of XZ projects are available on GitHub again

#2

Post by stux » Tue, Apr 09, 2024, 10:52 PM UTC

Edit: nvm, dupe of https://news.ycombinator.com/item?id=39984512

Re: The Git repositories of XZ projects are available on GitHub again

#3

Post by abricq » Wed, Apr 10, 2024, 8:49 AM UTC

I notice that user JiaT75 is still the second biggest contributor of the project. Interesting that his account is still alive.

Re: The Git repositories of XZ projects are available on GitHub again

#4

Post by OJFord » Wed, Apr 10, 2024, 9:03 AM UTC

abricq wrote: post #3

I notice that user JiaT75 is still the second biggest contributor of the project. Interesting that his account is still alive.

Having your code reverted only decreases your contribution metric in the sense that the denominator grows but it's someone else's (the reverter's) numerator: it's based on commits, not git blame.

Re: The Git repositories of XZ projects are available on GitHub again

#5

Post by type0 » Wed, Apr 10, 2024, 9:28 AM UTC

abricq wrote: post #3

I notice that user JiaT75 is still the second biggest contributor of the project. Interesting that his account is still alive.

yeah, so maybe Jia should get maintainer rights after all /s

Re: The Git repositories of XZ projects are available on GitHub again

#6

Post by shp0ngle » Wed, Apr 10, 2024, 10:50 AM UTC

The actual maintainers of the repo seem to take the position that all "Jia Tan" commits are backdoor-free unless proven otherwise, so most of his commits still stay (as they* did a LOT of actual, real work on the repo).

I am curious what people think about that. It's still around 30k lines of code made by a known malicious entity, looking at git blame. However it seems mostly fine?

* plural "they" ;)

Re: The Git repositories of XZ projects are available on GitHub again

#7

Post by rvnx » Wed, Apr 10, 2024, 11:35 AM UTC

type0 wrote: post #5

abricq wrote: post #3

I notice that user JiaT75 is still the second biggest contributor of the project. Interesting that his account is still alive.

yeah, so maybe Jia should get maintainer rights after all /s

You are all quick judging here, let's not forget presumption of innocence

Re: The Git repositories of XZ projects are available on GitHub again

#8

Post by axus » Wed, Apr 10, 2024, 11:38 AM UTC

rvnx wrote: post #7

type0 wrote: post #5

Earlier quoted context omitted.

yeah, so maybe Jia should get maintainer rights after all /s

You are all quick judging here, let's not forget presumption of innocence

I think that's what got xz into trouble in the first place.

Re: The Git repositories of XZ projects are available on GitHub again

#9

Post by phkahler » Wed, Apr 10, 2024, 11:41 AM UTC

rvnx wrote: post #7

type0 wrote: post #5

Earlier quoted context omitted.

yeah, so maybe Jia should get maintainer rights after all /s

You are all quick judging here, let's not forget presumption of innocence

>> let's not forget presumption of innocence

Are you trying to be sarcastic?

Re: The Git repositories of XZ projects are available on GitHub again

#10

Post by cedws » Wed, Apr 10, 2024, 12:14 PM UTC

shp0ngle wrote: post #6

The actual maintainers of the repo seem to take the position that all "Jia Tan" commits are backdoor-free unless proven otherwise, so most of his commits still stay (as they* did a LOT of actual, real work on the repo). I am curious what people think about that. It's still around 30k lines of code made by a known malicious entity, looking at git blame. However it seems mostly fine? * plural "they" ;)

I'm surprised that this implementation of xz written by... well... random people has been adopted so widely. I would've expected a more 'industrial' implementation managed by Google or Meta or something, but there isn't one.