3 ms·
But what are you suggesting exactly? The code fragment you quoted was awk code. Awk is a generic programming language. Any programming language can be written t
by mrb 3y ago
But what are you suggesting exactly? The code fragment you quoted was awk code. Awk is a generic programming language. Any programming language can be written to be complex and unreadable.
- pelasaco 3y ago> Any programming language can be written to be complex and unreadable. The question is you as lead developer, reviewing a commit with a complex and unreadable code snippet, what would you do?
- edflsafoiewq 3y agoYou would reject it of course, which is exactly why this code never appeared in a commit. The stage 0 of the exploit was not checked in, but directly added to the autogenerated build script in the release tarball, where, even if someone did review the script, it looks plausibly like other autogenerated build gunk. The complex and unreadable scripts in the further stages were hidden inside binary test files, so no one reviewing the commit that added them (https://git.tukaani.org/?p=xz.git;a=commit;h=cf44e4b https://git.tukaani.org/?p=xz.git;a=commit;h=cf44e4b) would directly see that code.
- mrb 3y agoBut this awk code was not committed in the clear so it was not possible to review. It was hidden in a binary file, compressed and encrypted.