7 ms·

The social side of this is really haunting me over the last days. It's surprisingly easy to pressure people to giving up control. I've been there myself. I can'

The social side of this is really haunting me over the last days. It's surprisingly easy to pressure people to giving up control. I've been there myself. I can't even imagine how devastating this must be to the original author of XZ, especially if he is dealing with other personal issues as well. I hope at least this will serve a strong example to other open source people, to never allow others to pressure them into something they are not comfortable with.

tommiegannert 3y ago
The Jigar Kumar nudges are so incredibly rude. I would have banned the account, but perhaps they contributed something positive as well that isn't mentioned. I wonder if it would be possible to crowdsource FOSS mailing list moderation.
- goku12 3y ago
  There is a good chance that everyone in that thread except the original maintainer is in on the act. It's likely that all those accounts are managed by a single person or group. Targeting just one account for rudeness isn't going to help, if that's true.
  - lukaslalinsky 3y ago
    It does help on the social/psychological side. If you, as an open source project maintainer, have a policy that such rudeness is not acceptable, you are much less likely to become a successful victim of a social attack like this.
    - sigmar 3y ago
      That would be true if you could ban the person from using new emails, but I don't think that's true when the thread if rife with sock puppet accounts. You ban the first rude email account, then there will be 2 new accounts complaining about both the lack of commits and the "heavy-handed mailing-list moderation" stifling differing views.
      - geodel 3y ago
        Absolutely right. Considering there is a whole cottage industry about asshole replies from Linus Torvalds on linux mailing lists. For lesser/individual maintainers there is no way to survive this kind of mob attack. Corporate maintainers may be able to manage as it could be considered just as paid job and there are worse ways to make money.
      - pixl97 3y ago
        Yep, as the attacker you bias the entire playing field to your side. If a mailing list has 20 or so users on it, you create 50 accounts over time that are nice, helpful, and set a good tone. Then later you come in with your attack and the pushy assholes. Suddenly those 50 puppets just slightly side with the asshole. Most people break under that kind of social pressure and cave to the jerks request.
    - michaelt 3y ago
      It's entirely possible for an evildoer to make someone feel bad while remaining completely polite. First send a message to the mailing list as "Alice" providing a detailed bug report for a real bug, and a flawless patch to fix it. Then you reply to the mailing list as "Bob" agreeing that it's a bug, thanking "Alice" for the patch and the time she spent producing such a detailed bug report, then explaining that unfortunately it won't be merged any time soon, then apologising and saying you know how frustrating it must be for Alice. Your two characters have been model citizens: Alice has contributed a good quality bug report, and code. Bob has helped the project by confirming bug reports, and has never been rude or critical - merely straightforward, realistic and a bit overly polite.
      - lukaslalinsky 3y ago
        As someone else said in this thread, scammers are often rude, because it makes people act fast, polite responses give them time to think. Of course, people are very easily manipulated. But by completely rejecting rudeness and having the mindset to not let others put pressure on me, you will improve the odds by a lot.
  - cduzz 3y ago
    Reminds me of the "no soap radio" joke. Joke being euphemism for collective gas lighting, but typically a "joke" played by kids on each other. Play is just preparing for the same game but when stakes are higher? https://en.wikipedia.org/wiki/No_soap_radio https://en.wikipedia.org/wiki/No_soap_radio
  - imglorp 3y ago
    The mechanism employed here seems like the good cop, bad cop interrogation/negotiation technique. There is the one person who has taken care to show cultural and mission alignment. Then there are several misaligned actors applying pressure which the first person can relieve. How to identify and defuse: https://www.pon.harvard.edu/daily/batna/the-good-cop-bad-cop-negotiation-strategy/ https://www.pon.harvard.edu/daily/batna/the-good-cop-bad-cop...
  - r00fus 3y ago
    The act relies on there being an extreme reluctance to ban. Once the banhammer has been used, the act kind of falls apart. Of course, difference pressure campaigns can then be brought to bear. We live in an adversarial environment, time to stop playing naively nice. Ideally it isn't the maintainer that has to do all this work.
- TheCondor 3y ago
  The xz list traffic was remarkably low. More than a few times over the years, I thought it broke or I was unsubscribed. Messages like Jigar’s are kind of par for the course.
- coldpie 3y ago
  > I would have banned the account Yeah, same. We should be much more willing to kick jerks out of our work spaces. The work is hard enough as it is without also being shit on while you do it.
- delfinom 3y ago
  Yea people are too accepting of allowing asshats like the Jigar messages. Simple ban and get the fuck out. Too often I've dealt with people trying to rationalize it as much as "o its just cultural, they don't understand". No, get the fuck out. But hey I'm a NYer and telling people to fuck off is a past time.
  - nindalf 3y ago
    Jigar was the same person/group as Jia. They were the bad cop and Jia was the good cop. Banning wouldn't have changed anything. Even if Jigar had been banned, the maintainer would still have appreciated the good cop's helpful contributions in contrast to the unhelpful bad cop. Jia would have become a maintainer anyway.
- soraminazuki 3y ago
  Not surprising, unfortunately. You'd think malicious actors would be nice to people they're trying to deceive. But after watching a few Kitboga videos, I learned that they more often yell, abuse, and swear at their victims instead.
  - pixl97 3y ago
    Being nice gives people time to think. Being mean is stressful and stops your brain from working properly. If someone doesn't allow you to be abusive, then they are not a mark. Predators look for prey that falls into certain patterns.
- jeltz 3y ago
  I think that is intentional and that the goal would have been achieved even if Jigar (who probably is the same guy as Jia) had been banned.
- npteljes 3y ago
  >I wonder if it would be possible to crowdsource FOSS mailing list moderation. I think this could be a genuine use of an AI: to go through all of the shit, and have it summarized in a fashion that the user wants: distant and objective, friendly, etc. It could provide an assessment on the general tone, aggregate the differently phrased requests, many things like that. Crowdsourcing would works best with the reddit / hacker news model I feel, where discussion happens in tree styled threads, and users can react to messages in ways that are not text, but something meta, like a vote or a reaction indicating tone. Both of these have significant downsides, but significant upsides too. People pick the mailing list in a similar way.
  - johnny22 3y ago
    A big problem is that people allow this sort of thing as part of the culture. I've followed the Fedora and PHP development mailing lists a few different times over the years ans this sort of thing was tolerated across the board. It doesn't matter if you crowdsource the moderation if nobody thinks the behavior is bad in the first place. Trying to do something about it was called censorship.
    - npteljes 3y ago
      I'm sorry I don't understand your point clearly. Why is it a big problem, and whose problem it is?
      - johnny22 3y ago
        The premise of the post I replied to is that the mailing list moderation is currently not great and that it allows people to be abusive. It suggest that we should crowdsource this moderation. I assume they think this will lower the burden. I myself do not think that this is the actual problem. I think the actual problem is that many FOSS communities have fostered an idea that cracking down on certain types of behavior is censorship. Of course they might all agree to ban somebody who is saying certain well known explicit words or being really really aggressive, but there's a lot of behavior that I would consider bannable but they do not. I'm trying to avoid mentioning specific cases because I don't wanna either reopen old wounds or cause another similar dustup. I can say that it reminds me a lot of the really old post about the 5 geek social fallacies https://plausiblydeniable.com/five-geek-social-fallacies/ https://plausiblydeniable.com/five-geek-social-fallacies/ In particular social fallacy #1 Obviously we're not talking about geek culture here (in general anyways). After rereading it, I saw something else that we actually do a see a lot even today. This in particular has happened on many a mailing list, including the ones I'm not specifically mentioning >> <SNIP> when nothing smacking of social selectiveness can be discussed in public, people inevitably begin to organize activities in secret. </SNIP> Well-known annoyances get tolerated for years, and the people who do the work start moving their discussions to bug trackers, irc, or in personal emails to avoid interacting with them.
- unethical_ban 3y ago
  It seems from the reading of this article that jigar is in on the scam. That said, I agree.
HPsquared 3y ago
I'm reminded of the short story "The Strange Case of Mr Pelham", in which a man is stalked and eventually replaced by a doppelganger. https://en.wikipedia.org/wiki/The_Strange_Case_of_Mr_Pelham https://en.wikipedia.org/wiki/The_Strange_Case_of_Mr_Pelham
NarcissistDev 3y ago
Thank the lord Lasse wasn’t maintaining the nuclear codes. In another thought, I hope the nukes aren’t on a rolling Debian distro.
nathell 3y ago
It makes Rich Hickey’s „Open Source Is Not About You” [0] particularly poignant. As a hobbyist developer/maintainer of open source projects, I strive to remember that this is my gift to the world, and it comes with no strings attached. If people have any expectations about the software, it’s for them to manage; if they depend on it somehow, it’s their responsibility to ensure timely resolution of issues. None of this translates to obligations on my part, unless I explicitly make promises. I empathize with Lasse having been slowed down by mental issues. I have, too. And we need to take good care of ourselves, and proactively prevent the burden of maintainership from exacerbating those issues. [0]: https://gist.github.com/g1eny0ung/9e7d4d0f72547a8d156452e76fa8f7a3 https://gist.github.com/g1eny0ung/9e7d4d0f72547a8d156452e76f...
- raxxorraxor 3y ago
  This is why I find some disclaimers in some open source projects quite superfiscial, that the software is provided as is without any warranty. Of course it is, this should be the obvious default. If there is a law that would entitle a user to more, it is a bug in legislation that needs urgent fixing.
- pixl97 3y ago
  >having been slowed down by mental issues Anyone and everyone in the OSS world should be concerned about this too. You have nation state level actors out there with massive amounts of information on you. How much information have you leaked to data brokers? These groups will know how much debt you're in. The status of your relationships. Your health conditions and medications? It would not take much on their part to make your life worse and increase your stress levels. Just imagine things like fake calls from your bank saying that debt of yours has been put in collections.
  - berniedurfee 3y ago
    Not just nation state actors. All that data is available to anyone with a credit card from legit data dealers.
- somat 3y ago
mirekrusin 3y ago
It's bizzare enough as it is to start asking questions to confirm that "mental issue" had natural cause.
- couchand 3y ago
  Your experiences may differ, but I'd say pretty much anyone who lived through the past few years has reason enough to pay careful attention to their mental health.
lr1970 3y ago
Look how brilliantly they selected their target project: (1) xz and the lib are widely used in the wild including linux kernel, systemd, openSSH; (2) single maintainer, low rate of maintenance; (3) the original maintainer has other problems in his life distracting them from paying closer attention to the project. I am wondering how many other OSS projects look similar and can be targeted in similar ways?
- baq 3y ago
  I'm thinking 95% of home automation which is full of obscure devices and half baked solutions which get patched up by enthusiasts and promptly forgotten about. Controlling someone's lights is probably less important than Debian's build fleet but it's a scary proposition for the impacted individual who happens to use one of those long tail home assistant integrations or whatever.
  - davedx 3y ago
    A lot of home automation controls EV charging these days too. Imagine an attack that syncs a country’s EV fleet to charge in a minute where demand is at a peak. You could cause some damage at the switchgear I bet if not worse
- apantel 3y ago
  Yes it seems a lot like a case of a predator picking off a weak and sick individual.
- lenerdenator 3y ago
  Many. We're in a tech slowdown right now. There are people who got used to a certain lifestyle who now have "seeking work" on their LinkedIn profiles, and who have property taxes in arrears that are listed in county newspapers-of-record. If you're an intelligence operative in the Silicon Valley area, these guys should be easy pickings. An envelope full of cash to make some financial problems go away in exchange for a few commits on the FOSS projects they contribute to or maintain.
- orthecreedence 3y ago
oefrha 3y ago
I’ve given semi-popular projects that I no longer had the bandwidth to maintain to random people who bothered to email, no pressuring needed. While those projects are probably four to five magnitudes less important than xz, still thousands of people would be affected if the random dude who emailed was malicious. What should I have done? Let the projects languish? Guess I’ll still take the chance in the future.
- 01HNNWZ0MV43FF 3y ago
  I guess all you can do is not give the brand away. Put a link saying "Hey this guy forked my project, I won't maintain it anymore, he may add malware, review and use at your own risk"
- patmorgan23 3y ago
  If it's open source they can just fork it, and if you're no longer maintain yours you can put a link over to their fork. (Or any other active forks). It's still on the user to vet new forms.
- account42 3y ago
  > What should I have done? Let the projects languish? Yes, if you can't find a successor you trust then let someone fork the project and build trust from 0 rather than transferring trust others' trust in you by handing over the project. This doesn't just apply to security concerns btw. - plenty of other ways in which a new maintainer might end up making the project worse (intentionally or through incompetence) compared to it not receiving any updates.
lenerdenator 3y ago
I feel for Lasse. It's time for more of the big vendors who use these projects in their offerings to step up and give people running these small projects more resources and structure. $20k to have maintainers for each project actually meet twice a year at a conference is chump change for the biggest vendors, especially when compared against the cost of the audits they'll now be doing on everything Jia Tan and Co. touched.
- cryptonector 3y ago
  As an OSS maintainer, $20k wouldn't help me enough unless I was retired. The issue is not money (or not just money), but time. If a maintainer has a full-time job, they may not have time, and developers/maintainers tend to have full-time jobs, so... Now maybe one could build a career out of OSS maintainerships, with work/time funded by lots of donations much smaller than a salary but amounting to a salary.
  - lenerdenator 3y ago
    I was thinking more of a fix to the issue of "who the hell's maintaining this package our distro/service/whatever is based on" than a way to make money. The bigger projects (like the kernel) and vendors (MS, IBM/Red Hat, Canonical, Google, etc.) all have a vested interest in knowing the actual identity and basic personalities of people who maintain the important packages. If maintainers avail themselves for a weekend at a conference twice a year (or maybe even a lighter commitment like a few short meetings with a manager) they get some resources for their efforts. The flip side of this, of course, is that these organizations will prefer to include packages from maintainers who agree to this arrangement over those who don't. Furthermore, these organizations are in a place to put experienced, trustworthy contributors on projects that need maintainers if need be. If Lasse had been able to go to, idk, the Linux Foundation and say, "Listen, I'm getting burnt out, got anyone?" and they said "Sure, we've got this contributor with an established record who would love to help maintain your project", none of this is happening right now.
deleted 3y ago
[deleted]
nebulous1 3y ago
In "Ghost in the Wires" Kevin Mitnik details one of the ways he obtained information was via a law enforcement receptionist* who he managed to trick into believing he was law enforcement over the phone. He obtained information this way multiple times over multiple years, and fostered a phone based friendship with this woman. He seemed to have no qualms in doing this. He was also turned on by multiple people who he considered close friends. In the book it did not seem that he had considered that it might not be a "them" problem. *my details may be off here, I read it some time ago

tommiegannert 3y ago

The Jigar Kumar nudges are so incredibly rude. I would have banned the account, but perhaps they contributed something positive as well that isn't mentioned. I wonder if it would be possible to crowdsource FOSS mailing list moderation.

goku12 3y ago
There is a good chance that everyone in that thread except the original maintainer is in on the act. It's likely that all those accounts are managed by a single person or group. Targeting just one account for rudeness isn't going to help, if that's true.
- lukaslalinsky 3y ago
  It does help on the social/psychological side. If you, as an open source project maintainer, have a policy that such rudeness is not acceptable, you are much less likely to become a successful victim of a social attack like this.
  - sigmar 3y ago
    That would be true if you could ban the person from using new emails, but I don't think that's true when the thread if rife with sock puppet accounts. You ban the first rude email account, then there will be 2 new accounts complaining about both the lack of commits and the "heavy-handed mailing-list moderation" stifling differing views.
    - geodel 3y ago
      Absolutely right. Considering there is a whole cottage industry about asshole replies from Linus Torvalds on linux mailing lists. For lesser/individual maintainers there is no way to survive this kind of mob attack. Corporate maintainers may be able to manage as it could be considered just as paid job and there are worse ways to make money.
    - pixl97 3y ago
      Yep, as the attacker you bias the entire playing field to your side. If a mailing list has 20 or so users on it, you create 50 accounts over time that are nice, helpful, and set a good tone. Then later you come in with your attack and the pushy assholes. Suddenly those 50 puppets just slightly side with the asshole. Most people break under that kind of social pressure and cave to the jerks request.
  - michaelt 3y ago
    It's entirely possible for an evildoer to make someone feel bad while remaining completely polite. First send a message to the mailing list as "Alice" providing a detailed bug report for a real bug, and a flawless patch to fix it. Then you reply to the mailing list as "Bob" agreeing that it's a bug, thanking "Alice" for the patch and the time she spent producing such a detailed bug report, then explaining that unfortunately it won't be merged any time soon, then apologising and saying you know how frustrating it must be for Alice. Your two characters have been model citizens: Alice has contributed a good quality bug report, and code. Bob has helped the project by confirming bug reports, and has never been rude or critical - merely straightforward, realistic and a bit overly polite.
    - lukaslalinsky 3y ago
      As someone else said in this thread, scammers are often rude, because it makes people act fast, polite responses give them time to think. Of course, people are very easily manipulated. But by completely rejecting rudeness and having the mindset to not let others put pressure on me, you will improve the odds by a lot.
- cduzz 3y ago
  Reminds me of the "no soap radio" joke. Joke being euphemism for collective gas lighting, but typically a "joke" played by kids on each other. Play is just preparing for the same game but when stakes are higher? https://en.wikipedia.org/wiki/No_soap_radio https://en.wikipedia.org/wiki/No_soap_radio
- imglorp 3y ago
  The mechanism employed here seems like the good cop, bad cop interrogation/negotiation technique. There is the one person who has taken care to show cultural and mission alignment. Then there are several misaligned actors applying pressure which the first person can relieve. How to identify and defuse: https://www.pon.harvard.edu/daily/batna/the-good-cop-bad-cop-negotiation-strategy/ https://www.pon.harvard.edu/daily/batna/the-good-cop-bad-cop...
- r00fus 3y ago
  The act relies on there being an extreme reluctance to ban. Once the banhammer has been used, the act kind of falls apart. Of course, difference pressure campaigns can then be brought to bear. We live in an adversarial environment, time to stop playing naively nice. Ideally it isn't the maintainer that has to do all this work.
TheCondor 3y ago
The xz list traffic was remarkably low. More than a few times over the years, I thought it broke or I was unsubscribed. Messages like Jigar’s are kind of par for the course.
coldpie 3y ago
> I would have banned the account Yeah, same. We should be much more willing to kick jerks out of our work spaces. The work is hard enough as it is without also being shit on while you do it.
delfinom 3y ago
Yea people are too accepting of allowing asshats like the Jigar messages. Simple ban and get the fuck out. Too often I've dealt with people trying to rationalize it as much as "o its just cultural, they don't understand". No, get the fuck out. But hey I'm a NYer and telling people to fuck off is a past time.
- nindalf 3y ago
  Jigar was the same person/group as Jia. They were the bad cop and Jia was the good cop. Banning wouldn't have changed anything. Even if Jigar had been banned, the maintainer would still have appreciated the good cop's helpful contributions in contrast to the unhelpful bad cop. Jia would have become a maintainer anyway.
soraminazuki 3y ago
Not surprising, unfortunately. You'd think malicious actors would be nice to people they're trying to deceive. But after watching a few Kitboga videos, I learned that they more often yell, abuse, and swear at their victims instead.
- pixl97 3y ago
  Being nice gives people time to think. Being mean is stressful and stops your brain from working properly. If someone doesn't allow you to be abusive, then they are not a mark. Predators look for prey that falls into certain patterns.
jeltz 3y ago
I think that is intentional and that the goal would have been achieved even if Jigar (who probably is the same guy as Jia) had been banned.
npteljes 3y ago
>I wonder if it would be possible to crowdsource FOSS mailing list moderation. I think this could be a genuine use of an AI: to go through all of the shit, and have it summarized in a fashion that the user wants: distant and objective, friendly, etc. It could provide an assessment on the general tone, aggregate the differently phrased requests, many things like that. Crowdsourcing would works best with the reddit / hacker news model I feel, where discussion happens in tree styled threads, and users can react to messages in ways that are not text, but something meta, like a vote or a reaction indicating tone. Both of these have significant downsides, but significant upsides too. People pick the mailing list in a similar way.
- johnny22 3y ago
  A big problem is that people allow this sort of thing as part of the culture. I've followed the Fedora and PHP development mailing lists a few different times over the years ans this sort of thing was tolerated across the board. It doesn't matter if you crowdsource the moderation if nobody thinks the behavior is bad in the first place. Trying to do something about it was called censorship.
  - npteljes 3y ago
    I'm sorry I don't understand your point clearly. Why is it a big problem, and whose problem it is?
    - johnny22 3y ago
      The premise of the post I replied to is that the mailing list moderation is currently not great and that it allows people to be abusive. It suggest that we should crowdsource this moderation. I assume they think this will lower the burden. I myself do not think that this is the actual problem. I think the actual problem is that many FOSS communities have fostered an idea that cracking down on certain types of behavior is censorship. Of course they might all agree to ban somebody who is saying certain well known explicit words or being really really aggressive, but there's a lot of behavior that I would consider bannable but they do not. I'm trying to avoid mentioning specific cases because I don't wanna either reopen old wounds or cause another similar dustup. I can say that it reminds me a lot of the really old post about the 5 geek social fallacies https://plausiblydeniable.com/five-geek-social-fallacies/ https://plausiblydeniable.com/five-geek-social-fallacies/ In particular social fallacy #1 Obviously we're not talking about geek culture here (in general anyways). After rereading it, I saw something else that we actually do a see a lot even today. This in particular has happened on many a mailing list, including the ones I'm not specifically mentioning >> <SNIP> when nothing smacking of social selectiveness can be discussed in public, people inevitably begin to organize activities in secret. </SNIP> Well-known annoyances get tolerated for years, and the people who do the work start moving their discussions to bug trackers, irc, or in personal emails to avoid interacting with them.
unethical_ban 3y ago
It seems from the reading of this article that jigar is in on the scam. That said, I agree.

HPsquared 3y ago

I'm reminded of the short story "The Strange Case of Mr Pelham", in which a man is stalked and eventually replaced by a doppelganger. https://en.wikipedia.org/wiki/The_Strange_Case_of_Mr_Pelham https://en.wikipedia.org/wiki/The_Strange_Case_of_Mr_Pelham

NarcissistDev 3y ago

Thank the lord Lasse wasn’t maintaining the nuclear codes. In another thought, I hope the nukes aren’t on a rolling Debian distro.

nathell 3y ago

It makes Rich Hickey’s „Open Source Is Not About You” [0] particularly poignant. As a hobbyist developer/maintainer of open source projects, I strive to remember that this is my gift to the world, and it comes with no strings attached. If people have any expectations about the software, it’s for them to manage; if they depend on it somehow, it’s their responsibility to ensure timely resolution of issues. None of this translates to obligations on my part, unless I explicitly make promises. I empathize with Lasse having been slowed down by mental issues. I have, too. And we need to take good care of ourselves, and proactively prevent the burden of maintainership from exacerbating those issues. [0]: https://gist.github.com/g1eny0ung/9e7d4d0f72547a8d156452e76fa8f7a3 https://gist.github.com/g1eny0ung/9e7d4d0f72547a8d156452e76f...

raxxorraxor 3y ago
This is why I find some disclaimers in some open source projects quite superfiscial, that the software is provided as is without any warranty. Of course it is, this should be the obvious default. If there is a law that would entitle a user to more, it is a bug in legislation that needs urgent fixing.
pixl97 3y ago
>having been slowed down by mental issues Anyone and everyone in the OSS world should be concerned about this too. You have nation state level actors out there with massive amounts of information on you. How much information have you leaked to data brokers? These groups will know how much debt you're in. The status of your relationships. Your health conditions and medications? It would not take much on their part to make your life worse and increase your stress levels. Just imagine things like fake calls from your bank saying that debt of yours has been put in collections.
- berniedurfee 3y ago
  Not just nation state actors. All that data is available to anyone with a credit card from legit data dealers.
somat 3y ago

mirekrusin 3y ago

It's bizzare enough as it is to start asking questions to confirm that "mental issue" had natural cause.

couchand 3y ago
Your experiences may differ, but I'd say pretty much anyone who lived through the past few years has reason enough to pay careful attention to their mental health.

lr1970 3y ago

Look how brilliantly they selected their target project: (1) xz and the lib are widely used in the wild including linux kernel, systemd, openSSH; (2) single maintainer, low rate of maintenance; (3) the original maintainer has other problems in his life distracting them from paying closer attention to the project. I am wondering how many other OSS projects look similar and can be targeted in similar ways?

baq 3y ago
I'm thinking 95% of home automation which is full of obscure devices and half baked solutions which get patched up by enthusiasts and promptly forgotten about. Controlling someone's lights is probably less important than Debian's build fleet but it's a scary proposition for the impacted individual who happens to use one of those long tail home assistant integrations or whatever.
- davedx 3y ago
  A lot of home automation controls EV charging these days too. Imagine an attack that syncs a country’s EV fleet to charge in a minute where demand is at a peak. You could cause some damage at the switchgear I bet if not worse
apantel 3y ago
Yes it seems a lot like a case of a predator picking off a weak and sick individual.
lenerdenator 3y ago
Many. We're in a tech slowdown right now. There are people who got used to a certain lifestyle who now have "seeking work" on their LinkedIn profiles, and who have property taxes in arrears that are listed in county newspapers-of-record. If you're an intelligence operative in the Silicon Valley area, these guys should be easy pickings. An envelope full of cash to make some financial problems go away in exchange for a few commits on the FOSS projects they contribute to or maintain.
orthecreedence 3y ago

oefrha 3y ago

I’ve given semi-popular projects that I no longer had the bandwidth to maintain to random people who bothered to email, no pressuring needed. While those projects are probably four to five magnitudes less important than xz, still thousands of people would be affected if the random dude who emailed was malicious. What should I have done? Let the projects languish? Guess I’ll still take the chance in the future.

01HNNWZ0MV43FF 3y ago
I guess all you can do is not give the brand away. Put a link saying "Hey this guy forked my project, I won't maintain it anymore, he may add malware, review and use at your own risk"
patmorgan23 3y ago
If it's open source they can just fork it, and if you're no longer maintain yours you can put a link over to their fork. (Or any other active forks). It's still on the user to vet new forms.
account42 3y ago
> What should I have done? Let the projects languish? Yes, if you can't find a successor you trust then let someone fork the project and build trust from 0 rather than transferring trust others' trust in you by handing over the project. This doesn't just apply to security concerns btw. - plenty of other ways in which a new maintainer might end up making the project worse (intentionally or through incompetence) compared to it not receiving any updates.

lenerdenator 3y ago

I feel for Lasse. It's time for more of the big vendors who use these projects in their offerings to step up and give people running these small projects more resources and structure. $20k to have maintainers for each project actually meet twice a year at a conference is chump change for the biggest vendors, especially when compared against the cost of the audits they'll now be doing on everything Jia Tan and Co. touched.

cryptonector 3y ago
As an OSS maintainer, $20k wouldn't help me enough unless I was retired. The issue is not money (or not just money), but time. If a maintainer has a full-time job, they may not have time, and developers/maintainers tend to have full-time jobs, so... Now maybe one could build a career out of OSS maintainerships, with work/time funded by lots of donations much smaller than a salary but amounting to a salary.
- lenerdenator 3y ago
  I was thinking more of a fix to the issue of "who the hell's maintaining this package our distro/service/whatever is based on" than a way to make money. The bigger projects (like the kernel) and vendors (MS, IBM/Red Hat, Canonical, Google, etc.) all have a vested interest in knowing the actual identity and basic personalities of people who maintain the important packages. If maintainers avail themselves for a weekend at a conference twice a year (or maybe even a lighter commitment like a few short meetings with a manager) they get some resources for their efforts. The flip side of this, of course, is that these organizations will prefer to include packages from maintainers who agree to this arrangement over those who don't. Furthermore, these organizations are in a place to put experienced, trustworthy contributors on projects that need maintainers if need be. If Lasse had been able to go to, idk, the Linux Foundation and say, "Listen, I'm getting burnt out, got anyone?" and they said "Sure, we've got this contributor with an established record who would love to help maintain your project", none of this is happening right now.

deleted 3y ago

[deleted]

nebulous1 3y ago

In "Ghost in the Wires" Kevin Mitnik details one of the ways he obtained information was via a law enforcement receptionist* who he managed to trick into believing he was law enforcement over the phone. He obtained information this way multiple times over multiple years, and fostered a phone based friendship with this woman. He seemed to have no qualms in doing this. He was also turned on by multiple people who he considered close friends. In the book it did not seem that he had considered that it might not be a "them" problem. *my details may be off here, I read it some time ago