4 ms·
This reminds me of The Linux Backdoor Attempt of 2003[0], when someone (maybe a three-letter agency, maybe not) was able to insert a subtle bug in the Linux ker
by 1f60c 6y ago
This reminds me of The Linux Backdoor Attempt of 2003[0], when someone (maybe a three-letter agency, maybe not) was able to insert a subtle bug in the Linux kernel.
[0]: https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-...
- yjftsjthsd-h 6y ago> was able to insert a subtle bug in the Linux kernel. ... was able to insert a bug into a mirror of the kernel, which was caught in short order.
- joosters 6y ago... which was caught in short order That means nothing, of course it was caught, otherwise we'd never had heard about it. We can only speculate about the ones that haven't been caught...
- yjftsjthsd-h 6y agoWe can look at why it was caught (people paying attention to commits, policy of requiring commits to be properly signed off), and conclude that it would be difficult to add anything without being caught. Or, put differently, if you believe that bad actors can get around that level of precautions, you might as well give up because everything else would be equally compromised.
- 1f60c 6y agoI thought BitKeeper was the main repo and CVS was the mirror?
- yjftsjthsd-h 6y agoYeah, from that link: > But some people didn’t like BitKeeper, so a second copy of the source code was kept so that developers could get the code via another code system called CVS. The CVS copy of the code was a direct clone of the primary BitKeeper copy.