5 ms·

> You appeal to trust people and give them the benefit of doubt which is normally a good thing. But is this appropiate here? Yes. Without evidence to the cont

> You appeal to trust people and give them the benefit of doubt which is normally a good thing. But is this appropiate here? Yes. Without evidence to the contrary there is no reason to believe Lasse has been anything other than genuine so all you're doing is insulting and slandering them out of personal satisfaction. And conspiratorial witch hunts are actively counter-productive, through that mode of thinking it doesn't take much imagination to figure out you are part of the conspiracy for instance.

w4ffl35 3y ago
[flagged]
- w4ffl35 3y ago
  [flagged]
  - w4ffl35 3y ago
    [flagged]
    - rmast 3y ago
      Recall that the original maintainer had mental health issues and other things that likely led to the perceived need to bring on someone to help maintain xz. This brings up some integrity questions about you and other people bringing forth accusations in order to make the original maintainer feel pressure to bring on someone else to replace the one that inserted a backdoor after several years of ostensibly legitimate commits. Hopefully this helps you see that these sorts of accusations are a slippery slope and unproductive. Heck, you could then turnaround and accuse me of doing something nefarious by accusing you.
      - thinkingemote 3y ago
        It's possible that he was intentionally pressured and his mental health made bad or worse by the adversary to increase stress. The adversary would then propose to help them reduce the stress. It's probably straight out of many playbooks.
        deleted 3y ago
        [deleted]
        w4ffl35 3y ago
        Additionally to the guy's above point, replacing him after this incident would complete that play
      - w4ffl35 3y ago
        Actually my solution as outlined on twitter was to enforce non anon commits, and i stated it is a bad idea to replace him, so try again. And, as stated above, I don't think he's malicious, it's still something that must be considered. Sweeping the possibility away is weird.
        rmast 3y ago
        I don’t stalk all of your social media posts, so from my perspective I don’t see any of the solutions you’ve posted elsewhere — which brings up a good point to keep in mind: none of us see the complete picture (or can read minds to know what someone else really thinks). The possibility can be kept in mind and considered even if it isn’t being actively discussed. I think in this case, most people think he is not malicious — and feel that unless new compelling evidence to show otherwise appears, potentially starting a harmful rumor based on speculation is counterproductive.
        w4ffl35 3y ago
        I'm not starting a harmful rumor. People are asking legitimate questions in order to paint the whole picture. Being gaslit is very weird. > I don't stalk your socials I mentioned it because you called my intent into question. Why are people running cover for the maintainer of a repo that just tried to backdoor sshd when others are asking legitimate questions?
        rmast 3y ago
        You might not be trying to start a rumor, but other people could when they try to answer the questions from a place of ignorance — if you take a look at the comments on a gist summarizing the backdoor, there are quite a few comments by z-nonymous that seem to be insinuating that other specific GitHub users are complicit in things by looking at their commits in various non-xz repositories. No one is running cover, just that most information so far points to the original maintainer not knowing that the person brought on to help out had ulterior motives, and likely wasn’t even who they purported to be. If you were running an open source project and facing burnout as the sole maintainer, I’d imagine you’d exercise perfect judgement and do a full background check on the person offering to help? I think many of us would like to believe we’d do better, but the reality is, most of us would have fallen for the same trick. So now imagine having to deal with the fallout not just on the technical side, but also the never-ending questions surrounding your professional reputation that people just keep bring up — sounds like a recipe for depression, possibly even suicidal thoughts.
jnxx 3y ago
The thing is there are two possibilities: 1. An important project has an overburdened / burnt out maintainer, and that project is taken over by a persona who appears to help kindly, but is part of a campaign of a state actor. 2. A state actor is involved in setting up such a project from the start. The first possibility is not only being an asshole to the original maintainer, but it is also more risky - that original maintainer surely feels responsible for his creation and could ring alarm bells. This is not unlikely because he knows the code. And alarm bells is something that state actors do not like. The second possibility has the risk of the project not being successful, which would mean a serious investment in resources to fail. But that could be countered by having competent people working on that. And in that case, you don't have any real persons,just account names. What happened here? I don't know.
- Delk 3y ago
  I don't think state actors would care one bit about being assholes. Organized crime black hats probably wouldn't either. The original maintainer has said in the past, before Jia Tan's increased involvement and stepping up as a maintainer, that he couldn't put as much into the project due to mental health and other reasons [1]. Seems to fit possibility number one rather well. If you suspect that Lasse Collin was somehow in it from the start, that'd mean the actor orchestrated the whole thing about mental health and not being able to keep up with sole maintainership. Why would they even do that if they had the project under their control already? Of course we don't know what's really been happening with the project recently, or who's behind the backdoor and how. But IMO creating suspicions about the original maintainer's motives based entirely on speculation is also a bit assholey. edit: [1] https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...
  - jnxx 3y ago
    > Why would they even do that More layers of obfuscation. For example in order to be able to attribute the backdoor to a different party. It is of course also possible that Lasse Collins is a nice real person who just has not been able to review this. Maybe he is too ill,or has to care for an ill spouse, or perhaps he is not even alive any more. Who knows him as a person (not just an account name) and knows how he is doing?

w4ffl35 3y ago

[flagged]

w4ffl35 3y ago
[flagged]
- w4ffl35 3y ago
  [flagged]
  - rmast 3y ago
    Recall that the original maintainer had mental health issues and other things that likely led to the perceived need to bring on someone to help maintain xz. This brings up some integrity questions about you and other people bringing forth accusations in order to make the original maintainer feel pressure to bring on someone else to replace the one that inserted a backdoor after several years of ostensibly legitimate commits. Hopefully this helps you see that these sorts of accusations are a slippery slope and unproductive. Heck, you could then turnaround and accuse me of doing something nefarious by accusing you.
    - thinkingemote 3y ago
      It's possible that he was intentionally pressured and his mental health made bad or worse by the adversary to increase stress. The adversary would then propose to help them reduce the stress. It's probably straight out of many playbooks.
      - deleted 3y ago
        [deleted]
      - w4ffl35 3y ago
        Additionally to the guy's above point, replacing him after this incident would complete that play
    - w4ffl35 3y ago
      Actually my solution as outlined on twitter was to enforce non anon commits, and i stated it is a bad idea to replace him, so try again. And, as stated above, I don't think he's malicious, it's still something that must be considered. Sweeping the possibility away is weird.
      - rmast 3y ago
        I don’t stalk all of your social media posts, so from my perspective I don’t see any of the solutions you’ve posted elsewhere — which brings up a good point to keep in mind: none of us see the complete picture (or can read minds to know what someone else really thinks). The possibility can be kept in mind and considered even if it isn’t being actively discussed. I think in this case, most people think he is not malicious — and feel that unless new compelling evidence to show otherwise appears, potentially starting a harmful rumor based on speculation is counterproductive.
        w4ffl35 3y ago
        I'm not starting a harmful rumor. People are asking legitimate questions in order to paint the whole picture. Being gaslit is very weird. > I don't stalk your socials I mentioned it because you called my intent into question. Why are people running cover for the maintainer of a repo that just tried to backdoor sshd when others are asking legitimate questions?
        rmast 3y ago
        You might not be trying to start a rumor, but other people could when they try to answer the questions from a place of ignorance — if you take a look at the comments on a gist summarizing the backdoor, there are quite a few comments by z-nonymous that seem to be insinuating that other specific GitHub users are complicit in things by looking at their commits in various non-xz repositories. No one is running cover, just that most information so far points to the original maintainer not knowing that the person brought on to help out had ulterior motives, and likely wasn’t even who they purported to be. If you were running an open source project and facing burnout as the sole maintainer, I’d imagine you’d exercise perfect judgement and do a full background check on the person offering to help? I think many of us would like to believe we’d do better, but the reality is, most of us would have fallen for the same trick. So now imagine having to deal with the fallout not just on the technical side, but also the never-ending questions surrounding your professional reputation that people just keep bring up — sounds like a recipe for depression, possibly even suicidal thoughts.

jnxx 3y ago

The thing is there are two possibilities: 1. An important project has an overburdened / burnt out maintainer, and that project is taken over by a persona who appears to help kindly, but is part of a campaign of a state actor. 2. A state actor is involved in setting up such a project from the start. The first possibility is not only being an asshole to the original maintainer, but it is also more risky - that original maintainer surely feels responsible for his creation and could ring alarm bells. This is not unlikely because he knows the code. And alarm bells is something that state actors do not like. The second possibility has the risk of the project not being successful, which would mean a serious investment in resources to fail. But that could be countered by having competent people working on that. And in that case, you don't have any real persons,just account names. What happened here? I don't know.

Delk 3y ago
I don't think state actors would care one bit about being assholes. Organized crime black hats probably wouldn't either. The original maintainer has said in the past, before Jia Tan's increased involvement and stepping up as a maintainer, that he couldn't put as much into the project due to mental health and other reasons [1]. Seems to fit possibility number one rather well. If you suspect that Lasse Collin was somehow in it from the start, that'd mean the actor orchestrated the whole thing about mental health and not being able to keep up with sole maintainership. Why would they even do that if they had the project under their control already? Of course we don't know what's really been happening with the project recently, or who's behind the backdoor and how. But IMO creating suspicions about the original maintainer's motives based entirely on speculation is also a bit assholey. edit: [1] https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...
- jnxx 3y ago
  > Why would they even do that More layers of obfuscation. For example in order to be able to attribute the backdoor to a different party. It is of course also possible that Lasse Collins is a nice real person who just has not been able to review this. Maybe he is too ill,or has to care for an ill spouse, or perhaps he is not even alive any more. Who knows him as a person (not just an account name) and knows how he is doing?