4 ms·

I don't want to read too much into it, but the person (supposedly) submitting the PR seems to work at 1Password since December last year, as per his Linkedin. (

• returningfory2 3y ago
  Yeah the GitHub account looks really really legitimate. Maybe it was compromised though?
  • jethro_tell 3y ago
    What looks legit about a gmail address and some stock art for a profile?
    • gpm 3y ago
      [Deleted per below]
      • TeMPOraL 3y ago
        Can you stay in that org after leaving Google?
        • bananapub 3y ago
          whoever is in charge of removing people from the Google github org has the itchiest trigger finger in the whole exiting-the-company process tree.
        • fooker 3y ago
          No
      • Jyaif 3y ago
        You are not looking at the right profile. This is the profile that people are talking about: https://github.com/jaredallard https://github.com/jaredallard
        • gpm 3y ago
          Oops, you're absolutely correct. Deleted (via edit) my comment above. Thanks.
      • ncr100 3y ago
        He was just (50 minutes ago) removed from the oss fuzz repo. I hope this also (at least temporarily until verification of 'bad/good') remove him from the org?
    • buildbot 3y ago
      Plus the README.md that is just a rickroll
  • ncr100 3y ago
    The 2 GMail accounts are 85% / mainly associated with XZ work, since 2021, per searching for them explicitly via Google.
  • computerfriend 3y ago
    The PR's two commits are signed by a key that was also used to sign previous commits belonging to that author.
    • dralley 3y ago
      Hold up, are you saying that https://github.com/jaredallard https://github.com/jaredallard and the accounts affiliated with this XZ backdoor share a PGP key? Or something else?
      • computerfriend 3y ago
        No, this account made a PR and their commits were signed [1]. Take a look at their other repositories, e.g. they did AoC 2023 in Rust and published it, the commits in that repository are signed by the same key. So this is not (just) a GitHub account compromise. I find this aspect to be an outlier, the other attacker accounts were cutouts. So this doesn't quite make sense to me. [1] https://github.com/jamespfennell/xz/pull/2/commits https://github.com/jamespfennell/xz/pull/2/commits
• bombcar 3y ago
  If I were trying to compromise supply chains, getting into someplace like 1Password would be high up on the list. Poor guy, he's probably going to get the third degree now.
• switch007 3y ago
  As a 1Password user, I just got rather nervous.
  • bombcar 3y ago
    Yubikeys starting to look kinda yummy.
    • wiml 3y ago
      Hardware gets backdoored too, remember Crypto AG?
• lelandbatey 3y ago
  They're definitely a real person. I know cause that "1Password employee since December" is a person I know IRL and worked with for years at their prior employer. They're not a no-name person or a fake identity just FYI. Please don't be witch hunting; this genuinely looks like an unfortunate case where Jared was merely proactively doing their job by trying to get an externally maintained golang bindings of XZ to the latest version of XZ. Jared's pretty fantastic to work with and is definitely the type of person to be filing PRs on external tools to get them to update dependencies. I think the timing is comically bad, but I can vouch for Jared. https://github.com/jamespfennell/xz/pull/2 https://github.com/jamespfennell/xz/pull/2
  • greatjack613 3y ago
    [flagged]
    • lelandbatey 3y ago
      Here's a PR on an employer-owned public Github repository where I made a change and Jared approved it. Please, let's not witch hunt. https://github.com/getoutreach/stencil-golang/pull/404 https://github.com/getoutreach/stencil-golang/pull/404