6 ms·

I hope Lasse Collin is doing OK! Here is a older message from him [1] "I haven't lost interest but my ability to care has been fairly limited mostly due to lon

by Epa095 3y ago

I hope Lasse Collin is doing OK! Here is a older message from him [1] "I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. It's also good to keep in mind that this is an unpaid hobby project. " Github (Microsoft) are in a unique position to figure out if his account is hacked or not, and find a way to reach him. I hope they reach out and offer him some proper support! Economic support (if that's needed), or just help clearing his name. This is another tale of how we are building multi trillion dollar industries on the back of unpaid volunteers. It's not github 'job', and many other organisations have benefited even more from Lasses work, but they are in a unique position, and would be literally pocket change for them. 1:https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...

syslog 3y ago
Relevant xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/
cbolton 3y ago
In a movie his mental health issues would likely have been caused intentionally by the attacker, setting the stage for the mole to offer to step in just at the right time. Seems a bit far fetched in this case though for what looks like a tangential attack.
- maerF0x0 3y ago
  or > Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. Is actually Jia Tan has him tied up in a basement and is posing as him. State actors can do that kind of thing.
  - account42 3y ago
    In that case why bother with the Jia Tan persona at all instead of just pushing the malware as Lasse Collin.
- deanresin 3y ago
  In a movie, he was killed by foreign state actors, and his identity assumed by the foreign state hacker. Actually, someone should check on him.
- account42 3y ago
  > what looks like a tangential attack Does it? I expect that finding someone vulnerable was the more likely approach rather than messing with the life of a stable maintainer, but it does seem very much like the attacker was acting with malicious intent from the start of his interaction with the xz project.
delfinom 3y ago
He came on IRC, he seemed ok. He did some cleanup of access and signed off for easter.
- farmdve 3y ago
  I mean, he was right at least. Jia Tan did have a bigger role.
- 400thecat 3y ago
  which IRC channel ?
  - rkta 3y ago
    The official channel for the project.
slavik81 3y ago
Lasse appears to be active and working on undoing the sabotage. https://git.tukaani.org/?p=xz.git;a=blobdiff;f=CMakeLists.txt;h=0e4d464faba62a1270b40a0cb24c2c59e4ace409;hp=1f0191673b453ed789d915e35ee874a17818494a;hb=f9cf4c05edd14dedfe63833f8ccbe41b55823b00;hpb=af071ef7702debef4f1d324616a0137a5001c14c https://git.tukaani.org/?p=xz.git;a=blobdiff;f=CMakeLists.tx...
- grumpyprole 3y ago
  I would start restoring trust by reverting all this guys commits. It's the best way to be sure.
k8svet 3y ago
I would like to see more attention given to this. I'm capable of compartmentalization and not over-guilting myself, but holy hell, I really hope he's doing alright. This would kind of destroy me. I was actually telling my dad about this. I have a project, 500+ users, not quite root access, but enough to cause serious damage. I can think of at least one covert way to backdoor the binary artifacts from it. About two years ago, someone showed up, started making good commits. In this case, they have some other community rep that goes back a bit further but... man it's an unsettling feeling.
- 01apr2029 3y ago
  > I'm capable of compartmentalization teach me how. help me learn how, please. any resources with practical utility you can share? or any class of therapists that are good at teaching this with right frameworks offered? thank you

by Epa095 3y ago

syslog 3y ago

Relevant xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/

cbolton 3y ago

In a movie his mental health issues would likely have been caused intentionally by the attacker, setting the stage for the mole to offer to step in just at the right time. Seems a bit far fetched in this case though for what looks like a tangential attack.

maerF0x0 3y ago
or > Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. Is actually Jia Tan has him tied up in a basement and is posing as him. State actors can do that kind of thing.
- account42 3y ago
  In that case why bother with the Jia Tan persona at all instead of just pushing the malware as Lasse Collin.
deanresin 3y ago
In a movie, he was killed by foreign state actors, and his identity assumed by the foreign state hacker. Actually, someone should check on him.
account42 3y ago
> what looks like a tangential attack Does it? I expect that finding someone vulnerable was the more likely approach rather than messing with the life of a stable maintainer, but it does seem very much like the attacker was acting with malicious intent from the start of his interaction with the xz project.

delfinom 3y ago

He came on IRC, he seemed ok. He did some cleanup of access and signed off for easter.

farmdve 3y ago
I mean, he was right at least. Jia Tan did have a bigger role.
400thecat 3y ago
which IRC channel ?
- rkta 3y ago
  The official channel for the project.

slavik81 3y ago

Lasse appears to be active and working on undoing the sabotage. https://git.tukaani.org/?p=xz.git;a=blobdiff;f=CMakeLists.txt;h=0e4d464faba62a1270b40a0cb24c2c59e4ace409;hp=1f0191673b453ed789d915e35ee874a17818494a;hb=f9cf4c05edd14dedfe63833f8ccbe41b55823b00;hpb=af071ef7702debef4f1d324616a0137a5001c14c https://git.tukaani.org/?p=xz.git;a=blobdiff;f=CMakeLists.tx...

grumpyprole 3y ago
I would start restoring trust by reverting all this guys commits. It's the best way to be sure.

k8svet 3y ago

I would like to see more attention given to this. I'm capable of compartmentalization and not over-guilting myself, but holy hell, I really hope he's doing alright. This would kind of destroy me. I was actually telling my dad about this. I have a project, 500+ users, not quite root access, but enough to cause serious damage. I can think of at least one covert way to backdoor the binary artifacts from it. About two years ago, someone showed up, started making good commits. In this case, they have some other community rep that goes back a bit further but... man it's an unsettling feeling.

01apr2029 3y ago
> I'm capable of compartmentalization teach me how. help me learn how, please. any resources with practical utility you can share? or any class of therapists that are good at teaching this with right frameworks offered? thank you