3 ms·

> Have you considered reaching out to the maintainers of that project and (politely) asking them to explain? That's kind of a catch-22, right? They'd explain w

> Have you considered reaching out to the maintainers of that project and (politely) asking them to explain? That's kind of a catch-22, right? They'd explain with a seemingly good answer if they did it for actual reasons. They'll still explain with a seemingly good answer if they did it for nefarious reasons. I don't have a good answer to this except to monitor this dependency and its changes.

wholinator2 3y ago
Is it possible that it was added by a bad actor, and that most of the individuals in contact will not have signed off on it? I mean, this whole thing started by an interested party digging deeper than anyone else had, you could trigger that for someone else. At the very least, what do you have to lose? If the best they can do is look like they're fine, then every possible side effect is to root up a frighteningly well hidden inflator
NarcissistDev 3y ago
They’d definitely have a great answer up their sleeves. The crazy thing is the devs responsible for the XZ backdoor are among us and will likely be here on HN, downvoting comments which are getting close to the truth and upvoting each other. The bad people are definitely here.
ToneWashed 3y ago
I'm not sure it's a catch-22, there are many possibilities and subsequent outcomes. I would just want to satiate my curiosity. You assume they'll have a good reason, but they may not. They could be a malicious actor but also suck at it, and you might spook them into reconsidering. Or they may be fully innocent and just suck at packaging and distributing software and you might help them learn something. If they do have a good reason, it should stand on its own merits when presented. Anyone could be up to no good and they might be plotting the end of the world, but they also might coincidentally and not relatedly happen to like xz-utils a lot.

wholinator2 3y ago

Is it possible that it was added by a bad actor, and that most of the individuals in contact will not have signed off on it? I mean, this whole thing started by an interested party digging deeper than anyone else had, you could trigger that for someone else. At the very least, what do you have to lose? If the best they can do is look like they're fine, then every possible side effect is to root up a frighteningly well hidden inflator

NarcissistDev 3y ago

They’d definitely have a great answer up their sleeves. The crazy thing is the devs responsible for the XZ backdoor are among us and will likely be here on HN, downvoting comments which are getting close to the truth and upvoting each other. The bad people are definitely here.

ToneWashed 3y ago

I'm not sure it's a catch-22, there are many possibilities and subsequent outcomes. I would just want to satiate my curiosity. You assume they'll have a good reason, but they may not. They could be a malicious actor but also suck at it, and you might spook them into reconsidering. Or they may be fully innocent and just suck at packaging and distributing software and you might help them learn something. If they do have a good reason, it should stand on its own merits when presented. Anyone could be up to no good and they might be plotting the end of the world, but they also might coincidentally and not relatedly happen to like xz-utils a lot.