3 ms·
> There was a bit of a kerfuffle (https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4) about subve
by Ukv 3y ago
> There was a bit of a kerfuffle (https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4) about subverting open source projects recently
> [...]
> A well established identity on the internet creates a form of inner piece
Worth noting that the motivating incident (xz backdoor) was a user with legitimate history under what at the time appeared to be a real name. Even mandatory ID verification may not have helped in this case, if they're a state actor.
- deleted 3y ago[deleted]
- o11c 3y agoBut, if they had presented such a passport, we would know they were a state actor. Or at least be able to assume it to a much more reasonable degree.
- hosteur 3y agoAnd what difference does that make - Really?
- tbarbugli 3y agoit increases the cost for the attacker, forging ID is expensive and against the law. It also leaves behind additional evidence that might be useful to investigators
- dakiol 3y agoThe attacker wasn’t a random kid having fun. If they have the resources to do this kind of attack, they can definitely forge IDs.
- xanathar 3y agoReally? Organized crime also produces fake documents, and they are sold/smuggled to independent actors constantly. Plus, identity theft is not an uncommon crime.