6 ms·

Edit: I misunderstood what I was reading in the link below, my original comment is here for posterity. :) > From down in the same mail thread: it looks like th

Edit: I misunderstood what I was reading in the link below, my original comment is here for posterity. :) > From down in the same mail thread: it looks like the individual who committed the backdoor has made some recent contributions to the kernel as well... Ouch. https://www.openwall.com/lists/oss-security/2024/03/29/10 https://www.openwall.com/lists/oss-security/2024/03/29/10 The OP is such great analysis, I love reading this kind of stuff!

davikr 3y ago
Lasse Collin is not Jia Tan until proven otherwise.
- robocat 3y ago
  Passive aggressive accusation. This style of fake doubt is really not appropriate anywhere.
- pavon 3y ago
  No, he likely is not. But the patch series includes commits co-developed by Jia Tan, and lists Jia Tan as a maintainer of the kernel module.
- verytrivial 3y ago
  Speaking only hypothetically, but two points: 1) No-one has been is proven to "be" anyone in this case. Reputation is OSS is built upon behaviour only, not identity. "Jia Tan" managed to tip the scales by also being helpful. That identity is 99% likely to be a confection. 2) People can do terrible things when strongly encouraged or worse coerced. Including dissolving identity boundaries. The first problem can be 'solved' by using real identities and web of trust but that will NEVER fly in OSS for a multitude of technical and social reasons. The second problem will simply never be solved in any context, OSS or otherwise. Bad actors be bad, yo.
Denvercoder9 3y ago
The referenced patch series had not made it into the kernel yet.
ibotty 3y ago
No that patch series is from Lasse. He said himself that it's not urgent in any way and it won't be merged this merge window, but nobody (sane) is accusing Lasse of being the bad actor.
wezdog1 3y ago
Also it may br a coincidence but JiaT75 looks a lot like Transponder 7500 which in aviation means hijacked...

davikr 3y ago

Lasse Collin is not Jia Tan until proven otherwise.

robocat 3y ago
Passive aggressive accusation. This style of fake doubt is really not appropriate anywhere.
pavon 3y ago
No, he likely is not. But the patch series includes commits co-developed by Jia Tan, and lists Jia Tan as a maintainer of the kernel module.
verytrivial 3y ago
Speaking only hypothetically, but two points: 1) No-one has been is proven to "be" anyone in this case. Reputation is OSS is built upon behaviour only, not identity. "Jia Tan" managed to tip the scales by also being helpful. That identity is 99% likely to be a confection. 2) People can do terrible things when strongly encouraged or worse coerced. Including dissolving identity boundaries. The first problem can be 'solved' by using real identities and web of trust but that will NEVER fly in OSS for a multitude of technical and social reasons. The second problem will simply never be solved in any context, OSS or otherwise. Bad actors be bad, yo.

Denvercoder9 3y ago

The referenced patch series had not made it into the kernel yet.

ibotty 3y ago

No that patch series is from Lasse. He said himself that it's not urgent in any way and it won't be merged this merge window, but nobody (sane) is accusing Lasse of being the bad actor.

wezdog1 3y ago

Also it may br a coincidence but JiaT75 looks a lot like Transponder 7500 which in aviation means hijacked...