6 ms·
Why can't they interview the guy who made it? Some say he's still posting on that board.
by Solvency 3y ago
Why can't they interview the guy who made it? Some say he's still posting on that board.
- buro9 3y agowho says that person exists? could well be a persona created for this purpose, with a team behind the persona
- tester457 3y agoI want the team to talk more, maybe something will slip out.
- humansareok1 3y agoWhy would they, imo signs point to a nation state or at minimum a very sophisticated APT so it seems incredibly unlikely they're going to make a mistake like that.
- cryptonector 3y agoIf a nation-state then revealing themselves could cause a serious diplomatic incident. If not a nation-state then revealing themselves could expose them to criminal prosecution. The perpetrators almost certainly have been busy erasing their tracks and going underground. If they're not caught in spite of their best efforts, we'll never hear from them again.
- Solvency 3y agowhere is there any law that says you can't put any code you want into open source that is completely visible, auditable , and reviewable by everyone who uses it? not challenging you. Genuinely curious.
- humansareok1 3y agoDoes this not fall under the US CFAA Laws? I.e. intentionally adding malicious code?
- cryptonector 3y agoThe CFAA is quite broad. I wouldn't be surprised if it's broad enough to allow for prosecution in this case. If you interpret the CFAA as narrowly as possible then you might only be able to prosecute when the backdoor is exercised, but at the very least that you could. And then there's the world outside the U.S., where the laws might be broader.
- ptx 3y agoWhy would it matter that the thing being sabotaged is "completely visible, auditable , and reviewable"? Do you have any specific laws in mind that you think would not apply? If you were referring to the malicious code being contributed, not to the open source project as a whole, I don't think "completely visible" is an accurate description of the deliberately obfuscated chain of m4 gobbledygook and binary blobs that makes up the backdoor.
- tonypace 3y agoThat board? What board?
- speedylight 3y agoWe should lure him/her with a bait, like the winrar source code or something… give him hope for redemption.