4 ms·

SSH compromise that's not really exploitable "900 comments", all fish dead within 60 miles "5 comments".

kalkr 3y ago
9 hours ago "more comments", 1 hour ago "less comments".
Latty 3y ago
I feel like it isn't a surprise Hacker News has more opinions on software security than enviornmental disaster. If you post about the backdoor to an environmental forum, I suspect it wouldn't gain as much traction.
saulrh 3y ago
For the average HNer, a fertilizer spill is unactionable. There's no digging I can do, nothing I can change. At most I can add it to the big list of things I should consider talking to my senators and representatives about. By contrast, the liblzma compromise is immediately actionable and HN is who should be reacting to it. I'd wager that some HN readers got paged this morning to deal with the liblzma compromise. There were debian and other distro maintainers on HN communicating about what they knew, what they were doing in response, and what the average HN reader should be doing. I wouldn't be surprised if a reasonable percentage of HN ran, not walked, to run updates on a potentially compromised Fedora installation. Furthermore, the data was all out in the open (git commit history, mailing lists) and in a format that HN readers are specialized for dealing with. A supply chain attack on openssh isn't just relevant to HN, it's the kind of thing that should be on HN because HN is full of the kind of person that we want to be spending time responding to this incident.
deleted 3y ago
[deleted]
mmh0000 3y ago
It makes perfect sense; other replies have already made good arguments, but I'll add mine. I am not in agriculture. I know very little about farming, and there is nothing I can realistically do to fix or prevent agricultural mishaps. On the other hand, I am in Tech. I know a lot about computers, and there are things I can do and learn from the SSH article. Also, the SSH article is more scary than some dead fish (Yeah, dead fish suck, but that's 1000 miles away from me and a localized problem). The sophistication of the XZ attack is scary. It looks like a group of malicious actors did it. How widespread are attacks like this? We only learned about the `xz` attack because a brilliant person dug into a very minor side-effect caused by the attack. Is the Linux Kernel compromised in a similar attack? Who knows. What about the 2 billion other libraries a modern Linux system depends on? How will we detect and prevent this from happening in the future?
aaron695 3y ago
[dead]

9 hours ago "more comments", 1 hour ago "less comments".

I feel like it isn't a surprise Hacker News has more opinions on software security than enviornmental disaster. If you post about the backdoor to an environmental forum, I suspect it wouldn't gain as much traction.

saulrh 3y ago

For the average HNer, a fertilizer spill is unactionable. There's no digging I can do, nothing I can change. At most I can add it to the big list of things I should consider talking to my senators and representatives about. By contrast, the liblzma compromise is immediately actionable and HN is who should be reacting to it. I'd wager that some HN readers got paged this morning to deal with the liblzma compromise. There were debian and other distro maintainers on HN communicating about what they knew, what they were doing in response, and what the average HN reader should be doing. I wouldn't be surprised if a reasonable percentage of HN ran, not walked, to run updates on a potentially compromised Fedora installation. Furthermore, the data was all out in the open (git commit history, mailing lists) and in a format that HN readers are specialized for dealing with. A supply chain attack on openssh isn't just relevant to HN, it's the kind of thing that should be on HN because HN is full of the kind of person that we want to be spending time responding to this incident.

deleted 3y ago

[deleted]

mmh0000 3y ago

It makes perfect sense; other replies have already made good arguments, but I'll add mine. I am not in agriculture. I know very little about farming, and there is nothing I can realistically do to fix or prevent agricultural mishaps. On the other hand, I am in Tech. I know a lot about computers, and there are things I can do and learn from the SSH article. Also, the SSH article is more scary than some dead fish (Yeah, dead fish suck, but that's 1000 miles away from me and a localized problem). The sophistication of the XZ attack is scary. It looks like a group of malicious actors did it. How widespread are attacks like this? We only learned about the `xz` attack because a brilliant person dug into a very minor side-effect caused by the attack. Is the Linux Kernel compromised in a similar attack? Who knows. What about the 2 billion other libraries a modern Linux system depends on? How will we detect and prevent this from happening in the future?

aaron695 3y ago

[dead]