3 ms·

This has plausible deniability on it. There's better ways to hide by swapping in Unicode lookalike characters. Some of them even pixel match depending on the f

This has plausible deniability on it. There's better ways to hide by swapping in Unicode lookalike characters. Some of them even pixel match depending on the font. Maybe I'm out of the loop but is intentionality settled here?

zzzeek 3y ago
the period right there on the left edge? if I saw that in a patch I'd be through the roof, that looks completely intentional
- aeyes 3y ago
  I'd never suspect this to be intentional if I'd spot it in a patch, even given the consequences in this particular case. I have written and committed things into code instead of writing it into some other window several times. Without a linter I probably wouldn't spot an extra dot when reviewing my own change before sending it out.
- kristopolous 3y ago
  Not me. Maybe someone is using an editor with a . key mapped to something. It's in a pretty convenient place. :wq!
- throwaway2037 3y ago
  I love this type of hindsight to 20-10 comment. "If I saw...". That is a BIG if. Plenty of smart people on that mailing also missed it. I missed it myself when I opened the HN lead link. Very subtle.
  - zzzeek 3y ago
    I dont use mailing lists for patches, I use gerrit that would put a great big highlight over that character
- Tuna-Fish 3y ago
  I distinctly remember having to remove such a superfluous . that I accidentally added into a file on multiple occasions. If you are using vi and your left shift key is dodgy, that can easily happen by accident.
- renewiltord 3y ago
  Double spacebar gives you period in some contexts on Mac.
n2d4 3y ago
Unicode lookalikes would be detected by IDEs and other tools. There would be plausible deniability in a different situation, but this is the same author who implemented the backdoor and several similar changes that disable security features. I don't think the benefit of doubt is deserved here.
- kristopolous 3y ago
  Ok there's a larger question here about the bazaar software development method. How can we ensure say, that Microsoft doesn't pay someone to throw a wrench in libre office development or Adobe to sabotage Gimp? There's lots of deception strategies for bad faith actors and given the paucity of people who actually do the work, it's really really hard to be picky. Especially with the complexity of library dependencies. Defect-at-a-distance may actually be a common strategy and this is the first that was caught
  - Dalewyn 3y ago
    >How can we ensure say, that Microsoft doesn't pay someone to throw a wrench in libre office development or Adobe to sabotage Gimp? Microsoft and Adobe have reputations to uphold long into the future. Is that infallible? Hell no it isn't, but consider that Jia Tan only needed to uphold his reputation insofar as getting his backdoor onto everyone's systems. Once that is done, his reputation or the lack thereof becomes a non-issue because his work is done. We're lucky we caught him just before the finish line. The likelihood of demonstrably reputable parties like Microsoft and Adobe poisoning the well is practically nil because they don't have a finish line.
    - kristopolous 3y ago
      Those companies are famous for skullduggery. They can secure the dominance of their offering against the open source competition for well under 500k a year. It's a no brainer. What this might look like would be say, poorly discernable icons, clumsy UI design, or an unstable API that makes plugins constantly break. Large volumes of documentation that are inadequate or inaccurate in critical places, etc. If I was malicious I'd pay someone to write otherwise functional code and bug fixes but make really user hostile decisions whenever possible. We should be diligent for this in a few key projects. Tech companies could easily be doing this already.
Tuna-Fish 3y ago
> Maybe I'm out of the loop but is intentionality settled here? Yes. The exploit used a payload, that was stored in the tests directory as a binary compression test case, but which is very clearly a very intentional exploit payload. All the sneaky stuff was about deploying that payload without it being obvious.

zzzeek 3y ago

the period right there on the left edge? if I saw that in a patch I'd be through the roof, that looks completely intentional

aeyes 3y ago
I'd never suspect this to be intentional if I'd spot it in a patch, even given the consequences in this particular case. I have written and committed things into code instead of writing it into some other window several times. Without a linter I probably wouldn't spot an extra dot when reviewing my own change before sending it out.
kristopolous 3y ago
Not me. Maybe someone is using an editor with a . key mapped to something. It's in a pretty convenient place. :wq!
throwaway2037 3y ago
I love this type of hindsight to 20-10 comment. "If I saw...". That is a BIG if. Plenty of smart people on that mailing also missed it. I missed it myself when I opened the HN lead link. Very subtle.
- zzzeek 3y ago
  I dont use mailing lists for patches, I use gerrit that would put a great big highlight over that character
Tuna-Fish 3y ago
I distinctly remember having to remove such a superfluous . that I accidentally added into a file on multiple occasions. If you are using vi and your left shift key is dodgy, that can easily happen by accident.
renewiltord 3y ago
Double spacebar gives you period in some contexts on Mac.

n2d4 3y ago

Unicode lookalikes would be detected by IDEs and other tools. There would be plausible deniability in a different situation, but this is the same author who implemented the backdoor and several similar changes that disable security features. I don't think the benefit of doubt is deserved here.

kristopolous 3y ago
Ok there's a larger question here about the bazaar software development method. How can we ensure say, that Microsoft doesn't pay someone to throw a wrench in libre office development or Adobe to sabotage Gimp? There's lots of deception strategies for bad faith actors and given the paucity of people who actually do the work, it's really really hard to be picky. Especially with the complexity of library dependencies. Defect-at-a-distance may actually be a common strategy and this is the first that was caught
- Dalewyn 3y ago
  >How can we ensure say, that Microsoft doesn't pay someone to throw a wrench in libre office development or Adobe to sabotage Gimp? Microsoft and Adobe have reputations to uphold long into the future. Is that infallible? Hell no it isn't, but consider that Jia Tan only needed to uphold his reputation insofar as getting his backdoor onto everyone's systems. Once that is done, his reputation or the lack thereof becomes a non-issue because his work is done. We're lucky we caught him just before the finish line. The likelihood of demonstrably reputable parties like Microsoft and Adobe poisoning the well is practically nil because they don't have a finish line.
  - kristopolous 3y ago
    Those companies are famous for skullduggery. They can secure the dominance of their offering against the open source competition for well under 500k a year. It's a no brainer. What this might look like would be say, poorly discernable icons, clumsy UI design, or an unstable API that makes plugins constantly break. Large volumes of documentation that are inadequate or inaccurate in critical places, etc. If I was malicious I'd pay someone to write otherwise functional code and bug fixes but make really user hostile decisions whenever possible. We should be diligent for this in a few key projects. Tech companies could easily be doing this already.

Tuna-Fish 3y ago

> Maybe I'm out of the loop but is intentionality settled here? Yes. The exploit used a payload, that was stored in the tests directory as a binary compression test case, but which is very clearly a very intentional exploit payload. All the sneaky stuff was about deploying that payload without it being obvious.