3 ms·

If a project targets a high-profile, very security sensitive project like the linux kernel from the start, as the archived tukaani web site linked above shows,

by jnxx 3y ago

If a project targets a high-profile, very security sensitive project like the linux kernel from the start, as the archived tukaani web site linked above shows, it is justified to ask questions. Also, the exploit shows a high effort, and a high level of competence, and a very obvious willingness to play a long game. These are not circumstances for applying Hanlon's razor.

matsemann 3y ago
Are you raising the same concerns and targeting individuals behind all other sensitive projects? No, because that would be insane. It's weird to have one set of standards to a maintainer since 2009 or so, and different standards for others. This witch hunt is just post-hoc smartassery.
- jnxx 3y ago
  Yes, I think if a project has backdoors and its old maintainers are unable to review them, I am more critical than with normal projects. As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning. And this is in part because I can not even tell for sure that he even exists. If I had met him a few times in a bar, I would be more inclined to believe he is not involved.
  - saagarjha 3y ago
    > As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning. Uh, because it's a compression library?
    - ljahier 3y ago
      From the project readme: > XZ Utils provide a general-purpose data-compression library plus 21 command-line tools. https://git.tukaani.org/?p=xz.git;a=blob;f=README;h=ac812ff150ca12bece1c266c5f4efe8e860be752;hb=HEAD https://git.tukaani.org/?p=xz.git;a=blob;f=README;h=ac812ff1...
  - UncleEntity 3y ago
    I'm inclined to believe that whatever state actor was involved sent a memo to their sockpuppets to do whatever they can to deflect blame away. See what I did there?

by jnxx 3y ago

matsemann 3y ago

Are you raising the same concerns and targeting individuals behind all other sensitive projects? No, because that would be insane. It's weird to have one set of standards to a maintainer since 2009 or so, and different standards for others. This witch hunt is just post-hoc smartassery.

jnxx 3y ago
Yes, I think if a project has backdoors and its old maintainers are unable to review them, I am more critical than with normal projects. As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning. And this is in part because I can not even tell for sure that he even exists. If I had met him a few times in a bar, I would be more inclined to believe he is not involved.
- saagarjha 3y ago
  > As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning. Uh, because it's a compression library?
  - ljahier 3y ago
    From the project readme: > XZ Utils provide a general-purpose data-compression library plus 21 command-line tools. https://git.tukaani.org/?p=xz.git;a=blob;f=README;h=ac812ff150ca12bece1c266c5f4efe8e860be752;hb=HEAD https://git.tukaani.org/?p=xz.git;a=blob;f=README;h=ac812ff1...
- UncleEntity 3y ago
  I'm inclined to believe that whatever state actor was involved sent a memo to their sockpuppets to do whatever they can to deflect blame away. See what I did there?