4 ms·

I get why people are focusing on this bad actor. But the question that interests me more: how many other apparent individuals fit the profile that this person p

I get why people are focusing on this bad actor. But the question that interests me more: how many other apparent individuals fit the profile that this person presented before caught?

Phenylacetyl 3y ago
Apparently, many. It looks like gettext may be containing a part of their attack infrastructure. https://github.com/microsoft/vcpkg/pull/37199#pullrequestreview-1924053615 https://github.com/microsoft/vcpkg/pull/37199#pullrequestrev... https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16d9c519b2d76f862abe4fe02d40f84e8daa712f7e08b616df3f16376c82431 https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16... https://github.com/MonicaLiu0311 https://github.com/MonicaLiu0311
- collinfunk 3y ago
  Are you referencing the '-unsafe' suffix in the second link? That is not something to worry about. This is from Gnulib, which is used by Gettext and other GNU projects. Using 'setlocale (0, NULL)' is not thread-safe on all platforms. Gnulib has modules to work around this, but not all projects want the extra locking. Hence the name '-unsafe'. :) See: https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg00127.html https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg001...
  - everybackdoor 3y ago
    They may be right: https://git.alpinelinux.org/aports/log/main/gettext https://git.alpinelinux.org/aports/log/main/gettext Timeline matches and there is a sudden switch of maintainer. And they add dependency to xz!
    - kaathewise 3y ago
      psykose was a prolific contributor to Alpine's aports, with thousands of commits over the past few years[0]. So, I doubt They're involved. [0]: https://git.alpinelinux.org/aports/stats/?period=y&ofs=10 https://git.alpinelinux.org/aports/stats/?period=y&ofs=10
      - everybackdoor 3y ago
        JiaT75 was also a prolific contributor to xz over the past few years, so your assumptions are generally invalid at this point.
  - deleted 3y ago
    [deleted]

I get why people are focusing on this bad actor. But the question that interests me more: how many other apparent individuals fit the profile that this person presented before caught?

Phenylacetyl 3y ago

Apparently, many. It looks like gettext may be containing a part of their attack infrastructure. https://github.com/microsoft/vcpkg/pull/37199#pullrequestreview-1924053615 https://github.com/microsoft/vcpkg/pull/37199#pullrequestrev... https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16d9c519b2d76f862abe4fe02d40f84e8daa712f7e08b616df3f16376c82431 https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16... https://github.com/MonicaLiu0311 https://github.com/MonicaLiu0311

collinfunk 3y ago
Are you referencing the '-unsafe' suffix in the second link? That is not something to worry about. This is from Gnulib, which is used by Gettext and other GNU projects. Using 'setlocale (0, NULL)' is not thread-safe on all platforms. Gnulib has modules to work around this, but not all projects want the extra locking. Hence the name '-unsafe'. :) See: https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg00127.html https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg001...
- everybackdoor 3y ago
  They may be right: https://git.alpinelinux.org/aports/log/main/gettext https://git.alpinelinux.org/aports/log/main/gettext Timeline matches and there is a sudden switch of maintainer. And they add dependency to xz!
  - kaathewise 3y ago
    psykose was a prolific contributor to Alpine's aports, with thousands of commits over the past few years[0]. So, I doubt They're involved. [0]: https://git.alpinelinux.org/aports/stats/?period=y&ofs=10 https://git.alpinelinux.org/aports/stats/?period=y&ofs=10
    - everybackdoor 3y ago
      JiaT75 was also a prolific contributor to xz over the past few years, so your assumptions are generally invalid at this point.
- deleted 3y ago
  [deleted]