4 ms·
Very strange behavior from the upstream developers. Possible government involvement? I have a feeling LANG is checked to target servers from particular countrie
by yogorenapan 3y ago
Very strange behavior from the upstream developers. Possible government involvement? I have a feeling LANG is checked to target servers from particular countries
- deleted 3y ago[deleted]
- _lvbh 3y agoOne thing to note is that the person that added the commits only started contributing around late 2022 and appears to have a Chinese name. Might be required by law to plant the backdoor. That would be quite scary considering they have contributed to a wide variety of projects including C++ https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp-docs?view=msvc-170 https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp...
- yorwba 3y agoI don't think you need to worry about the C++ contribution: https://github.com/MicrosoftDocs/cpp-docs/commit/9a96311122acd6c6de1e2624cd0f95655fac6500 https://github.com/MicrosoftDocs/cpp-docs/commit/9a96311122a...
- acdha 3y agoThis does make me wonder how much they made a deliberate effort to build an open source portfolio so they’d look more legitimate when time came to mount an attack. It seems expensive but it’s probably not really much at the scale of an intelligence agency.
- bombcar 3y agoIf I were doing it, I'd have a number of these "burner committers" ready to go when needed. If I were doing it AND amoral, I'd also be willing to find and compromise committers in various ways.
- kube-system 3y agoWhat's the salary for a software engineer in urban China? 60-80k/yr USD? Two years of that salary is cheaper than a good single shoulder fired missile. Seems like a pretty cheap attack vector to me. A Javelin is a quarter million per pop and they can only hit one target.
- acdha 3y agoYeah, exactly - when your army is measured in the millions, picking n hundred with technical aptitude is basically a rounding error.
- alwayslikethis 3y agoThey are paid much less than that. However, American weapons are also far overpriced due to high labor costs, among other things. The Chinese probably have cheaper weapons.
- catkitcourt 3y agoUnless the payment is performed by foreign entity (which means a US employer is hiring a Chinese hacker), it's not a wise choice to do currency exchange when measuring salary, because it would erase other facts affecting salary, like CPI or housing price. Apart from (both visible and invisible) taxes, I expect a senior programmer would earn ~500-700k CNY per year. Game programmers may reach up to 200k. For a team able to perform such attack, 1M/yr avg. might be reasonable. But if this is not a state-sponsored attack, I can't find enough interest. And, if this is state-backed...contractor or some dishonest officials would a huge part, so the real cost might be >2M/yr. Considering you can get nothing during 2 year's lurking I doubt if it's feasible enough.
- hartator 3y agoUntil you figure there are very subtle unicode changes in the URL that don’t diff on GitHub. :)
- deleted 3y ago[deleted]
- ComputerGuru 3y agoNo one is being “required by law” to add vulnerabilities, it’s more likely they are foreign agents to begin with.
- bombcar 3y agoDepends on the law and where you are. Publicly we have https://www.eff.org/issues/national-security-letters/faq https://www.eff.org/issues/national-security-letters/faq and it's likely that other requests have occurred from time to time, even in the USA.
- computerfriend 3y ago> No one is being “required by law” to add vulnerabilities This is absolutely not the case in many parts of the world.
- Phenylacetyl 3y ago[flagged]
- 8organicbits 3y ago> appears to have a Chinese name Given the complexity of the attack, I'd assume the name is fake.
- bdd8f1df777b 3y agoI would think a Chinese state hacker would not assume a Chinese name, just in case he was discovered like now.
- account42 3y agoBut your reaction being a common one would make a Chinese name the best pick for a Chines agent wanting to hide their country affiliation.
- dotty- 3y agoThe contribution to C++ is just a simple markdown change: https://github.com/MicrosoftDocs/cpp-docs/pull/4716 https://github.com/MicrosoftDocs/cpp-docs/pull/4716 C++ is fine.
- account42 3y agoAlso it's not a contribution to C++ but only one of Microsoft's projects around C++.
- anarazel 3y agoLANG only needs to have some value, the concrete value does not seem to matter.