9 ms·
The xz backdoor thing reminds me of a story
- smitty1e 3y ago[flagged]
- leoh 3y agoOk
- astrange 3y agoWas that before or after he told you people were hypnotizing you through the TV and tried to sell you nutritionally complete frozen burritos?
- DonHopkins 3y agoOr before or after he told you Black people are a hate group and White people should stay the hell away from Black people, and how to treat women: The Death of Dilbert and False Claims of White Victimhood: https://time.com/6259311/dilbert-racism-scott-adams/ https://time.com/6259311/dilbert-racism-scott-adams/ >“If nearly half of all Blacks are not OK with white people, according to this poll, not according to me, according to this poll,” Adams says calmly in the clip. “That’s a hate group. That’s a hate group and I don’t want anything to do with it. And I would say based on the current way things are going, the best advice I would give to white people is get the hell away from Black people. Just get the f-ck away. Wherever you have to go, just get away.” Dilbert’ Creator Scott Adams Compares Women Asking for Equal Pay to Children Demanding Candy: https://comicsalliance.com/scott-adam-sexist-mens-rights/ https://comicsalliance.com/scott-adam-sexist-mens-rights/ "The reality is that women are treated differently by society for exactly the same reason that children and the mentally handicapped are treated differently. It’s just easier this way for everyone. You don’t argue with a four-year old about why he shouldn’t eat candy for dinner. You don’t punch a mentally handicapped guy even if he punches you first. And you don’t argue when a women tells you she’s only making 80 cents to your dollar. It’s the path of least resistance. You save your energy for more important battles." -Scott Adams
- astrange 3y ago"It's real" and "it's not real" are both poor explanations of gender pay gaps that aren't educational. Claudia Goldin won a Nobel last year partly for explaining them - a rough summary is whether women work has changed over time (highest when everyone was a farmer, lowest 1950sish, now up again), the pay gap does exist currently and appears to be caused by having children, and prior to having children the current generation of women are paid more likely due to being more educated than men. The "it doesn't exist" argument is something like "it doesn't exist if you control for job choice and seniority level", which is an example of conditioning on a collider because those things are /caused by/ motherhood, so you can't control for them.
- smitty1e 3y agoTell HN: if the comment was somehow offensive, feedback on the specifics of the transgression would help to improve matters.
- strken 3y agoIt's a vague aphorism from a guy who went nuts with no added context to explain why it's relevant here. It's not offensive so much as low-quality and unrelated to the link.
- renewiltord 3y agoI don't doubt that this happened, but if you use e-verify and fill in Form I-9 how does this happen? I'm in the middle of hiring an F-1 student on OPT and I need to look at his EAD and verify it's not fake according to my lawyer. So I do. Nice and easy.
- furyofantares 3y agoIt says it was a couple decades ago
- astrange 3y agoCan't be that many (3?) if they made cell phones.
- furyofantares 3y agoI suppose I'm doubting that e-verify was ubiquitous 20 years ago, or nearly as likely to catch things.
- dboreham 3y agoAttacker's opsec presumably takes this into account.
- greyface- 3y agoIntelligence agencies can presumably mint valid SSNs along with other identity documents to use in situations like this.
- Aaargh20318 3y agoThey can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.
- GauntletWizard 3y ago
- jddj 3y agoI remember a few months ago there was a discussion[1] here about how fossil, the VCS for sqlite, should bring in a dependency on mermaid charts already. Nothing against mermaid, but I guess supply chain attacks are hard to conceptualise until they happen. When we're shortsighted we risk our mitigations against vague but serious threat models losing out against convenience. [1]https://news.ycombinator.com/item?id=38886344 https://news.ycombinator.com/item?id=38886344
- datascienced 3y agoCould a plugin architecture accommodate this?
- samatman 3y agoMany moons ago, I was active on the fossil list (right before it became a forum, one of the many things fossil has built-in), hoping to achieve the opposite of this: a libfossil containing the core technology for a fossil repo, without all the other stuff that comes along with it. Someone had started work on this, but was unable to complete it. The maintainers were willing to consider the idea, but not do it themselves, which is (always, for any request, on any open source project, at any time) completely understandable. I still think it would be great if someone with the ability/interest/time made it happen. Version control is useful for many things other than software, and fossil's architecture is well-suited for a linkable all-purpose revision control library.
- roenxi 3y agoWell... supply chain attacks are trivial to anticipate. A lot of modern programming (I'm thinking JavaScript especially when I say this) involves what seems to be 100s of dependencies. If there is a 1% chance of a random repo having a backdoor, the project will be compromised. That is clear and obvious. The problem is that the people who act on this and minimise dependencies are at a significant economic disadvantage to those who don't. A project with high risk tolerance has to write a fraction of the code and solve a fraction of the problems as someone who carefully writes secure software. The trade off isn't just "convenience", we're talking massive differentials in productivity that favour insecure models. It is much cheaper to accept that data will leak sooner or later, to the point where we can assume that if something is economically developed that is evidence it can't possibly be secure. That isn't an argument for more security though; if possible it is better to just design systems where leaks don't matter (eg, here in HN it isn't clear why I'd care about a leak - everything is already public except for the IP address in the server log).
- curiousgal 3y ago> None of his paychecks were ever cashed I don't understand this. People were paid by cheque in the early 2000s?
- nimih 3y agoI had the option to be paid by paper check as recently as 2017, and probably still would if I had remained working for that employer (a US-based legacy insurance carrier).
- 77pt77 3y agoNot from the US I guess? They are still ubiquitous today, let alone in the early 2000s.
- astrange 3y agoYou don't have to give your employer a bank account number, but they still have to pay you. Quite unusual for a tech contractor though.
- magicalhippo 3y ago> You don't have to give your employer a bank account number As a Norwegian that sounds so alien. They couldn't do anything but deposit money, so why wouldn't you?
- forrestthewoods 3y agoBecause you’re trying to plant backdoors you don’t want any paper trail? Almost everyone does direct deposit. But it’s not a legal requirement for an employee to be paid that way.
- magicalhippo 3y ago> Because you’re trying to plant backdoors you don’t want any paper trail? Good point, good point... I went to check, and it seems we've just recently plugged[1] that hole here in Norway. Salary and other benefits must be paid to a bank account now. [1]: https://www.gpokonomi.no/2022/01/26/forbud-mot-kontant-utbetaling-av-lonn-fra-1-januar-2022/ https://www.gpokonomi.no/2022/01/26/forbud-mot-kontant-utbet...
- deathanatos 3y agoMost of the details are out there but … > in that he had apparently downloaded a copy of everything … is a day in the office? I've done this, particularly at places that are "one repo == one project" organized (i.e., not monorepo): e.g., if I make a breaking change to a library, I'm going to update all the uses of that. Still to this day, the easiest way to do that is locally, with command line tooling.
- jonhohle 3y agoPlaces with reasonable build systems can do that for you. For example, poudriere on FreeBSD.
- indrora 3y agoIf you look at the Nintendo Gigaleaks, you'll discover that most of Nintendo hardware had one single CVS (later SVN) repository that held everything. Same with BroadOn, even up into 2010, when the cvs backup was taken. It's fairly well known that Google maintained a Stinky monorepo for a long time and one of the risks is someone just going and slurping the whole thing up onto a big enough drive and walking out the door.
- dilyevsky 3y agoThere’s someone commenting on the thread saying a background check will uncover an illegal agent. That’s cute
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- crotchfire 3y ago[flagged]
- dspillett 3y agoI'd much rather this than needing to agree to hundreds of commercial entities eating my data and spreading it to [deity] knows how many more, or clicking hundreds of "legitimate interest in our position as a stalker" checkboxes to opt out, which is required for taking stuff using many other publishing options. Requiring JS to read a simple article is undoubtedly wasteful, of course, but there are far worse insults you can make to you readership.
- 77pt77 3y agoThe next time something like this happens it will be a distribution packager (RedHat, arch, etc). They'll just release a package that has extra code than a clean build from source.
- bandrami 3y agoReproducible builds can help in theory, but in practice you're always using the potentially-compromised system itself to reproduce the build