8 ms·
XZ: Repo maintainer Lasse Collin responding on LKML
- oger 3y agoSigns of life from Lasse and a link to his web containing more information: https://tukaani.org/xz-backdoor/ https://tukaani.org/xz-backdoor/
- thinkingemote 3y agoDoesn't give much more information except that he wasn't immediately picked up by LEO. Poor guy will go through more stress now even more than that created and imposed on him over 2 years by the attacker. If anything we should encourage him to look back at his mental health as not being his fault and that we need to protect ourselves.
- chgs 3y ago> he wasn't immediately picked up by LEO. For what?
- Jonnax 3y agoSome people are trying to push a conspiracy theory that the maintainer and the contributor are the same person.
- thinkingemote 3y agoNo, I was going for questioning and help with their investigations. Seems like something serious and illegal happened. Possibly to do with a hostile state. Where I live, there would be at least 2 different organisations that would be very interested to find out what happened as quickly as possible. I don't for one second think he was involved but he would be essential in any investigation.
- saati 3y agoIn whose jurisdiction?
- TheFreim 3y agoI am not sure, but I'd expect the FBI's cyber crime division.
- Gizmox 3y agoIf you look at the list of (former) contributors of Tukaani, you will notice that an overwhelming majority of the names are Finnish, Lasse included, though he could also pass for Swedish. So FBI is going to investigate Github at most, unless Lasse has suddenly moved to the US or FBI has invaded Finland in some capacity. https://tukaani.org/about.html https://tukaani.org/about.html All meaningful new information will probably come from identifying Jia Tan, if that ever happens. I haven't done much reading yet, but it seems to me there was no connection between him and Lasse outside the Github project.
- chgs 3y agoWhat jurisdiction does the fbi have in Sweden?
- Nab443 3y ago> Where I live, there would be at least 2 different organisations that would be very interested to find out what happened as quickly as possible. What makes you that confident they would? What if Jia actually works for them?
- 2OEH8eoCRo0 3y agoQuestioning?
- junon 3y agoLasse has been active and answering questions on IRC over the last day or so. He says he'll be sharing more information on the XZ site in the days or weeks to come. He's doing fine, by the way, and mentions that the messages of support are appreciated but not necessary. He's more focused now on figuring out what happened, how he missed it, and deciding a plan of action for cleaning things up. (paraphrasing from conversations in the public channels)
- derpderp119 3y ago[flagged]
- guessmyname 3y agoOne could easily argue that everyone, except Americans, take their vacations seriously considering the lack of labour laws in the United States.
- bayindirh 3y agoLet me tell you, vacations are serious things. Makes you live longer, happier, and see places you didn't see before in many cases. Also, you can do whatever you want on that period of time. Which is marvelous in itself.
- dspillett 3y agoWe sure do, and this is a good thing. Some even here don't take care of themselves enough (including, but not limited to, taking proper breaks and other time for themselves). Work to live, don't live to work.
- Macha 3y agoI mean, even for my employer, it's their responsibility to staff appropriately so their employees can take a vacation. Never mind someone using an open source project "supplied as is"
- supposemaybe 3y ago[flagged]
- Beijinger 3y ago[flagged]
- throwaway11460 3y ago[flagged]
- Ekaros 3y agoJohn Smith here, I have some great ideas from my friends. Count me in!
- nolist_policy 3y agoIMHO the best course would be to freeze xz-utils. No new features but still keep it around so people can work with their existing xz files. People who want new features should switch to other projects like zstd.
- ikekkdcjkfke 3y agoYeah! Why isn't the library getting updated?! We needz more updatez!11!1
- publius_0xf3 3y agoYes, Lesse, there are many people who rely on this project and it is sad to see it fall into its current state. You must hand it over to someone who knows what they are doing. Now! -- Jigar Kumar
- supposemaybe 3y agoOr he could promise to never hand it over to anyone else again. Who cares about features.
- 3y ago
- skrebbel 3y agoPoints for Collin for letting his holiday take precedence over this mess. Don’t forget that he made xz for free, as a hobby project, and likely got duped by “Jia Tan” same as everybody else did. He’s not obligated to solve this on any particular timeline. Xz is not a business, so if your business got in trouble because a single solo hobby dev was a bit too trustful, it’s your job, and not his, to mitigate the problem.
- bayindirh 3y agoObligatory XKCD: https://xkcd.com/2347/ https://xkcd.com/2347/ Also, I'm on the same page with you. Block the malicious actor, continue sipping your coffee.
- JdeBP 3y agoI've said before, elsewhere, that I think that that cartoon is misleading. The truth, as should be apparent nowadays after the parade of leftpad, ntpd, xz, et al., is that there are thousands of those little blocks at the bottom that have a bus factor of 1 volunteer. There aren't any big long base blocks at all. And sometimes the little blocks seem as if they have been set up by domino topplers. (-:
- bayindirh 3y ago> There aren't any big long base blocks at all. Linux Kernel. libc. Compilers. Programming Languages. Big libraries like filesystems, while generally not open source, system ROMs. Tons of network and system RFCs, standards like POSIX. These are these long, wide, thin slabs you don't see. Others are too high level. These slabs are very close to metal. You're not kneeling enough. :)
- humanrebar 3y agoCompilers and programming languages tend to be under supported (or overcomitted?) for what it's worth. They're definitely not solo projects, but certain features and components can be basically that way. I take some of the recent concern from the Rust community about burnout and such to be early stage discovery of the economic problems in maintaining nontrivial infrastructure as a common good.
- klausa 3y agoThis post it timestamped March 30, which is "just" three days ago; but in this case is _over_ three days ago.
- seba_dos1 3y agoIt's the mail from Saturday, why would you post it now as if it was new? It was already discussed to death here.
- alecco 3y agoAlready discussed 2 days ago https://news.ycombinator.com/item?id=39874466 https://news.ycombinator.com/item?id=39874466
- em-bee 3y agothe discussion here is very different from previous discussions because it focuses on the role of the maintainer and not the incident itself. so no, we haven't already discussed this.
- richdodd 3y agoPosting in support of Collin. I'm sorry this happened to you, and thanks for your hard and thankless work!!