5 ms·

Points for Collin for letting his holiday take precedence over this mess. Don’t forget that he made xz for free, as a hobby project, and likely got duped by “J

Points for Collin for letting his holiday take precedence over this mess. Don’t forget that he made xz for free, as a hobby project, and likely got duped by “Jia Tan” same as everybody else did. He’s not obligated to solve this on any particular timeline. Xz is not a business, so if your business got in trouble because a single solo hobby dev was a bit too trustful, it’s your job, and not his, to mitigate the problem.

bayindirh 3y ago
Obligatory XKCD: https://xkcd.com/2347/ https://xkcd.com/2347/ Also, I'm on the same page with you. Block the malicious actor, continue sipping your coffee.
- JdeBP 3y ago
  I've said before, elsewhere, that I think that that cartoon is misleading. The truth, as should be apparent nowadays after the parade of leftpad, ntpd, xz, et al., is that there are thousands of those little blocks at the bottom that have a bus factor of 1 volunteer. There aren't any big long base blocks at all. And sometimes the little blocks seem as if they have been set up by domino topplers. (-:
  - bayindirh 3y ago
    > There aren't any big long base blocks at all. Linux Kernel. libc. Compilers. Programming Languages. Big libraries like filesystems, while generally not open source, system ROMs. Tons of network and system RFCs, standards like POSIX. These are these long, wide, thin slabs you don't see. Others are too high level. These slabs are very close to metal. You're not kneeling enough. :)
    - humanrebar 3y ago
      Compilers and programming languages tend to be under supported (or overcomitted?) for what it's worth. They're definitely not solo projects, but certain features and components can be basically that way. I take some of the recent concern from the Rust community about burnout and such to be early stage discovery of the economic problems in maintaining nontrivial infrastructure as a common good.
  - cbolton 3y ago
    But for the comics' physical analogy to work you'd then need to draw it in thousands of dimensions so that any block breaking would bring down the edifice...
    - TeMPOraL 3y ago
      Or draw them all bent and straining under the load, implying that any one of them failing will cause a cascade that brings the house down. (Though come to think of it, that would make the analogy less accurate, not more, by implying interdependency where there is none.)
michelsedgh 3y ago
I understand what you are saying and for open source community to have a good reputation and keep its standards high, these important packages have to start being actually maintained by the enterprises that depend on these. Most of businesses use Linux for their servers mainly Ubuntu/Debian and its just crazy for them to be vulnerable in such ways. Imagine how many other places backdoors can be installed even right now, and many of them won’t be visible and wont have performance issues like this one. 0.5s is a big deal in software and if it was 50ms or 5ms no one would have known this possibly for years. I wonder how safe the software we use actually is.
- ctrw 3y ago
  If you want professional developers pay professional rates. A doctor asks for a hundred bucks for 15 min.
  - michelsedgh 3y ago
    Yes and people are paying top money to Canonical and RedHat to maintain these software don’t you think? They have huge enterprise contracts and I feel like this should be on them? Im not blaming anyone it just goes to show how vulnerable they are. Also other linux distros, Fedora, arch, etc. they have the money and should make their software safe don’t you think?
    - Macha 3y ago
      Fedora is supported by Red Hat. And yes, I do think there is something to the fact that Red Hat is selling businesses commercial support for projects they have no expertise in, which probably means some of the pressure flows downwards from Red Hat's clients to the unpaid maintainers. Arch, (Gentoo, Nix, Mint, etc.) have no commercial aspect on the other hand and certainly doesn't have the money, but those distros are offered on the same "as is" basis as the downstream software.
    - Brian_K_White 3y ago
      Yes and haven't Canonical and RedHat and others already reacted and their users are fine? I see no problem.
xign 3y ago
I'm sorry but no. If you are responsible for the worst backdoor in recent computing history (which is probably a criminal act in nature), then you do have a responsibility to explain what went down. Maybe he can take a couple days to write it but I think more than that would be irresponsible. Collin is partially responsible because he gave the keys to Jia Tan. I don't want to burn him at the stake since he's a victim too but I think it's reasonable to expect him to help clean up this mess and at least help us fill in the gaps and understand what happened. Think about it this way. Say you are volunteering for a non-profit. You obviously don't have to do it and could just chill at home instead. But once you have agreed to say take a volunteer shift on Saturday, you are obligated to show up. Obviously no one can really stop you from skipping, but it would look bad on you and may get you banned from the non-profit. Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients. If you accidentally set the building on fire which ends up killing 5 people, I would also assume you would help in some fashion to clean up. Just because you are doing things for free does not mean you don't have social responsibility for your actions. You don't have to work, but just saying "oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that). Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology. Just want to point out that this isn't a typical "demand underpaid open source developers to work 24/7" issue here. This is a unique circumstance where his action has directly resulted in this happening. I feel bad for him being guilt-tripped to add a maintainer after reading through the old threads two years ago, and as I said I don't want to burn him at the stake, just saying that saying he has no responsibility to help at all is really a bad take.
- AtlasBarfed 3y ago
  Nope. Dissect "worst backdoor EVAR". Why is it bad? Is it because thousands of companies and millions of users depend on it? On one guy on holiday working for free! When we are essentially in two cold wars currently with ICBM nuclear powers? Linux is the battleground of cyber warfare, which is being funded by nations probably in the hundreds of billions of dollars. A trillion dollars or more of economic activity runs on it Windows? Come on, even buggier and less secure, and far less transparent. Monetary support of Linux maintainers is now a national security concern. You can't have hundred billions for attack and zero dollars for defense, that is a stupid strategy.

bayindirh 3y ago

Obligatory XKCD: https://xkcd.com/2347/ https://xkcd.com/2347/ Also, I'm on the same page with you. Block the malicious actor, continue sipping your coffee.

JdeBP 3y ago
I've said before, elsewhere, that I think that that cartoon is misleading. The truth, as should be apparent nowadays after the parade of leftpad, ntpd, xz, et al., is that there are thousands of those little blocks at the bottom that have a bus factor of 1 volunteer. There aren't any big long base blocks at all. And sometimes the little blocks seem as if they have been set up by domino topplers. (-:
- bayindirh 3y ago
  > There aren't any big long base blocks at all. Linux Kernel. libc. Compilers. Programming Languages. Big libraries like filesystems, while generally not open source, system ROMs. Tons of network and system RFCs, standards like POSIX. These are these long, wide, thin slabs you don't see. Others are too high level. These slabs are very close to metal. You're not kneeling enough. :)
  - humanrebar 3y ago
    Compilers and programming languages tend to be under supported (or overcomitted?) for what it's worth. They're definitely not solo projects, but certain features and components can be basically that way. I take some of the recent concern from the Rust community about burnout and such to be early stage discovery of the economic problems in maintaining nontrivial infrastructure as a common good.
- cbolton 3y ago
  But for the comics' physical analogy to work you'd then need to draw it in thousands of dimensions so that any block breaking would bring down the edifice...
  - TeMPOraL 3y ago
    Or draw them all bent and straining under the load, implying that any one of them failing will cause a cascade that brings the house down. (Though come to think of it, that would make the analogy less accurate, not more, by implying interdependency where there is none.)

michelsedgh 3y ago

I understand what you are saying and for open source community to have a good reputation and keep its standards high, these important packages have to start being actually maintained by the enterprises that depend on these. Most of businesses use Linux for their servers mainly Ubuntu/Debian and its just crazy for them to be vulnerable in such ways. Imagine how many other places backdoors can be installed even right now, and many of them won’t be visible and wont have performance issues like this one. 0.5s is a big deal in software and if it was 50ms or 5ms no one would have known this possibly for years. I wonder how safe the software we use actually is.

ctrw 3y ago
If you want professional developers pay professional rates. A doctor asks for a hundred bucks for 15 min.
- michelsedgh 3y ago
  Yes and people are paying top money to Canonical and RedHat to maintain these software don’t you think? They have huge enterprise contracts and I feel like this should be on them? Im not blaming anyone it just goes to show how vulnerable they are. Also other linux distros, Fedora, arch, etc. they have the money and should make their software safe don’t you think?
  - Macha 3y ago
    Fedora is supported by Red Hat. And yes, I do think there is something to the fact that Red Hat is selling businesses commercial support for projects they have no expertise in, which probably means some of the pressure flows downwards from Red Hat's clients to the unpaid maintainers. Arch, (Gentoo, Nix, Mint, etc.) have no commercial aspect on the other hand and certainly doesn't have the money, but those distros are offered on the same "as is" basis as the downstream software.
  - Brian_K_White 3y ago
    Yes and haven't Canonical and RedHat and others already reacted and their users are fine? I see no problem.

xign 3y ago

I'm sorry but no. If you are responsible for the worst backdoor in recent computing history (which is probably a criminal act in nature), then you do have a responsibility to explain what went down. Maybe he can take a couple days to write it but I think more than that would be irresponsible. Collin is partially responsible because he gave the keys to Jia Tan. I don't want to burn him at the stake since he's a victim too but I think it's reasonable to expect him to help clean up this mess and at least help us fill in the gaps and understand what happened. Think about it this way. Say you are volunteering for a non-profit. You obviously don't have to do it and could just chill at home instead. But once you have agreed to say take a volunteer shift on Saturday, you are obligated to show up. Obviously no one can really stop you from skipping, but it would look bad on you and may get you banned from the non-profit. Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients. If you accidentally set the building on fire which ends up killing 5 people, I would also assume you would help in some fashion to clean up. Just because you are doing things for free does not mean you don't have social responsibility for your actions. You don't have to work, but just saying "oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that). Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology. Just want to point out that this isn't a typical "demand underpaid open source developers to work 24/7" issue here. This is a unique circumstance where his action has directly resulted in this happening. I feel bad for him being guilt-tripped to add a maintainer after reading through the old threads two years ago, and as I said I don't want to burn him at the stake, just saying that saying he has no responsibility to help at all is really a bad take.

AtlasBarfed 3y ago
Nope. Dissect "worst backdoor EVAR". Why is it bad? Is it because thousands of companies and millions of users depend on it? On one guy on holiday working for free! When we are essentially in two cold wars currently with ICBM nuclear powers? Linux is the battleground of cyber warfare, which is being funded by nations probably in the hundreds of billions of dollars. A trillion dollars or more of economic activity runs on it Windows? Come on, even buggier and less secure, and far less transparent. Monetary support of Linux maintainers is now a national security concern. You can't have hundred billions for attack and zero dollars for defense, that is a stupid strategy.