4 ms·

Not sure why are people downvoting you... it's pretty unlikely that various Chinese IoT companies would just decide it's cool to add a backdoor, which clearly i

by zb3 3y ago

Not sure why are people downvoting you... it's pretty unlikely that various Chinese IoT companies would just decide it's cool to add a backdoor, which clearly implies that no matter how good their intentions are, they simply might have no other choice.

gpm 3y ago
There are roughly speaking two possibilities here: 1. His machine was compromised, he wasn't at fault past having less than ideal security (a sin we are all guilty of). His country or origin/residence is of no importance and doxing him isn't fair to him. 2. This account was malicious. There's no reason we should believe that the identity behind wasn't fabricated. The country of origin/residence is likely falsified. In neither case is trying to investigate who he is on a public forum likely to be productive. In both cases there's risk of aiming an internet mob at some innocent person who was 'set up'.
- zb3 3y ago
  Why do you exclude the possibility that this person was forced to add this at gunpoint?
  - encoderer 3y ago
    Yes exactly this. How do people think state actors have all those 0 day exploits. Excellent research? No! They are adding them themselves!
- rjzzleep 3y ago
  The back door is in the upstream GitHub tarball. The most obvious way to get stuff there is by compromising an old style GitHub token. The new style GitHub tokens are much better but it’s somewhat intransparent what options you need. Most people also don’t use expiring tokens. The authors seems to have a lot of oss contributions, so probably an easy target to choose.
- account42 3y ago
  I think the letters+numbers naming scheme for both the main account and the sockpuppets used to get him access to xz and the versions into distros is a strong hint at (2). Taking over xz maintainership without any history of open source contributions is also suspicious.
noncoml 3y ago
Because it’s naive to think that the owner of the account used his real identity.
- zb3 3y ago
  But my point is that people living in China might be "forced" to do such things, so we unfortunately can't ignore the country. Of course, practically this is problematic since the country can be faked
  - praut 3y ago
    [dead]

by zb3 3y ago

gpm 3y ago

There are roughly speaking two possibilities here: 1. His machine was compromised, he wasn't at fault past having less than ideal security (a sin we are all guilty of). His country or origin/residence is of no importance and doxing him isn't fair to him. 2. This account was malicious. There's no reason we should believe that the identity behind wasn't fabricated. The country of origin/residence is likely falsified. In neither case is trying to investigate who he is on a public forum likely to be productive. In both cases there's risk of aiming an internet mob at some innocent person who was 'set up'.

zb3 3y ago
Why do you exclude the possibility that this person was forced to add this at gunpoint?
- encoderer 3y ago
  Yes exactly this. How do people think state actors have all those 0 day exploits. Excellent research? No! They are adding them themselves!
rjzzleep 3y ago
The back door is in the upstream GitHub tarball. The most obvious way to get stuff there is by compromising an old style GitHub token. The new style GitHub tokens are much better but it’s somewhat intransparent what options you need. Most people also don’t use expiring tokens. The authors seems to have a lot of oss contributions, so probably an easy target to choose.
account42 3y ago
I think the letters+numbers naming scheme for both the main account and the sockpuppets used to get him access to xz and the versions into distros is a strong hint at (2). Taking over xz maintainership without any history of open source contributions is also suspicious.

noncoml 3y ago

Because it’s naive to think that the owner of the account used his real identity.

zb3 3y ago
But my point is that people living in China might be "forced" to do such things, so we unfortunately can't ignore the country. Of course, practically this is problematic since the country can be faked
- praut 3y ago
  [dead]