4 ms·

Never allow complexity in code or so-called engineers who ask to merge tons of shitty code. Get rid of that shit and don't trust committers blindly. Anyone who

Never allow complexity in code or so-called engineers who ask to merge tons of shitty code. Get rid of that shit and don't trust committers blindly. Anyone who enables this crap is also a liability.

plg94 3y ago
You do realize that "that shit" was part of the obfuscated and xz-compressed backdoor hidden as binary test file, right? It was never committed in plain sight. You can go to https://git.tukaani.org/xz.git https://git.tukaani.org/xz.git and look at the commits yourself – while the commits of the attacker are not prime examples of "good commits", they don't have glaringly obvious red flags either. This backdoor was very sophisticated and well-hidden, so your comment misses the point completely.
- johnisgood 3y ago
  > It was never committed in plain sight. It was though. I have seen those two test files being added by a commit on GitHub. Unfortunately it has been disabled by now, so I cannot give you a working link.
  - fullstop 3y ago
    It really wasn't, though. commit 74b138d2a6529f2c07729d7c77b1725a8e8b16f1 Author: Jia Tan <jiat0218@gmail.com> Date: Sat Mar 9 10:18:29 2024 +0800 Tests: Update two test files. The original files were generated with random local to my machine. To better reproduce these files in the future, a constant seed was used to recreate these files. diff --git a/tests/files/bad-3-corrupt_lzma2.xz b/tests/files/bad-3-corrupt_lzma2.xz index 926f95b0..f9ec69a2 100644 Binary files a/tests/files/bad-3-corrupt_lzma2.xz and b/tests/files/bad-3-corrupt_lzma2.xz differ diff --git a/tests/files/good-large_compressed.lzma b/tests/files/good-large_compressed.lzma index 8450fea8..878991f3 100644 Binary files a/tests/files/good-large_compressed.lzma and b/tests/files/good-large_compressed.lzma differ Would you bat an eye at this? If it were from a trusted developer and the code was part of a test case? If you looked at strings contained within the bad file, you might notice that this was not random: 7zXZ ####Hello#### 7zXZ w,( 7zXZ ####World#### But, again, this was a test case.
    - zzzeek 3y ago
      > Would you bat an eye at this? If it were from a trusted developer and the code was part of a test case? well lets all agree that now, if we see commits affecting / adding binary data with "this was generated locally with XYZ", that now we will bat an eye at it.
      - fullstop 3y ago
        Without a doubt!
    - johnisgood 3y ago
      Yeah, again, "committed in plain sight" it was, was it not? Batting an eye on it or not is another matter.
      - fullstop 3y ago
        If it's obfuscated or deceptive, as it was, it's really not plain sight.
        johnisgood 3y ago
        Some of his commits were NOT obfuscated, committed in plain sight, yet no one has batted an eye, for reasons. So whatever floats your boat by adding that sentence, regardless, and however you may define "plain sight". It is a binary file to begin with.
        fullstop 3y ago
        Can you point one out?
delfinom 3y ago
[flagged]
- mnau 3y ago
  For people who don't get raccoon in a dumpster reference: https://www.softwaremaxims.com/blog/not-a-supplier https://www.softwaremaxims.com/blog/not-a-supplier
swells34 3y ago
[flagged]
- dang 3y ago
  You can't attack other users on HN, no matter how annoying another comment is or you feel it is. We have to ban accounts that post this way, so please don't do it again. You've unfortunately been doing it repeatedly: https://news.ycombinator.com/item?id=39494039 https://news.ycombinator.com/item?id=39494039 https://news.ycombinator.com/item?id=39441168 https://news.ycombinator.com/item?id=39441168 If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

Never allow complexity in code or so-called engineers who ask to merge tons of shitty code. Get rid of that shit and don't trust committers blindly. Anyone who enables this crap is also a liability.

plg94 3y ago

You do realize that "that shit" was part of the obfuscated and xz-compressed backdoor hidden as binary test file, right? It was never committed in plain sight. You can go to https://git.tukaani.org/xz.git https://git.tukaani.org/xz.git and look at the commits yourself – while the commits of the attacker are not prime examples of "good commits", they don't have glaringly obvious red flags either. This backdoor was very sophisticated and well-hidden, so your comment misses the point completely.

johnisgood 3y ago
> It was never committed in plain sight. It was though. I have seen those two test files being added by a commit on GitHub. Unfortunately it has been disabled by now, so I cannot give you a working link.
- fullstop 3y ago
  It really wasn't, though. commit 74b138d2a6529f2c07729d7c77b1725a8e8b16f1 Author: Jia Tan <jiat0218@gmail.com> Date: Sat Mar 9 10:18:29 2024 +0800 Tests: Update two test files. The original files were generated with random local to my machine. To better reproduce these files in the future, a constant seed was used to recreate these files. diff --git a/tests/files/bad-3-corrupt_lzma2.xz b/tests/files/bad-3-corrupt_lzma2.xz index 926f95b0..f9ec69a2 100644 Binary files a/tests/files/bad-3-corrupt_lzma2.xz and b/tests/files/bad-3-corrupt_lzma2.xz differ diff --git a/tests/files/good-large_compressed.lzma b/tests/files/good-large_compressed.lzma index 8450fea8..878991f3 100644 Binary files a/tests/files/good-large_compressed.lzma and b/tests/files/good-large_compressed.lzma differ Would you bat an eye at this? If it were from a trusted developer and the code was part of a test case? If you looked at strings contained within the bad file, you might notice that this was not random: 7zXZ ####Hello#### 7zXZ w,( 7zXZ ####World#### But, again, this was a test case.
  - zzzeek 3y ago
    > Would you bat an eye at this? If it were from a trusted developer and the code was part of a test case? well lets all agree that now, if we see commits affecting / adding binary data with "this was generated locally with XYZ", that now we will bat an eye at it.
    - fullstop 3y ago
      Without a doubt!
  - johnisgood 3y ago
    Yeah, again, "committed in plain sight" it was, was it not? Batting an eye on it or not is another matter.
    - fullstop 3y ago
      If it's obfuscated or deceptive, as it was, it's really not plain sight.
      - johnisgood 3y ago
        Some of his commits were NOT obfuscated, committed in plain sight, yet no one has batted an eye, for reasons. So whatever floats your boat by adding that sentence, regardless, and however you may define "plain sight". It is a binary file to begin with.
        fullstop 3y ago
        Can you point one out?

delfinom 3y ago

[flagged]

mnau 3y ago
For people who don't get raccoon in a dumpster reference: https://www.softwaremaxims.com/blog/not-a-supplier https://www.softwaremaxims.com/blog/not-a-supplier

swells34 3y ago

[flagged]

dang 3y ago
You can't attack other users on HN, no matter how annoying another comment is or you feel it is. We have to ban accounts that post this way, so please don't do it again. You've unfortunately been doing it repeatedly: https://news.ycombinator.com/item?id=39494039 https://news.ycombinator.com/item?id=39494039 https://news.ycombinator.com/item?id=39441168 https://news.ycombinator.com/item?id=39441168 If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.