3 ms·

Some group of coders pissed off because the were rushed into shipping and a middle manager or two that were trying to make an arbitrary deadline blaming it on i

Some group of coders pissed off because the were rushed into shipping and a middle manager or two that were trying to make an arbitrary deadline blaming it on incompetent devs.

planede 3y ago
From https://research.swtch.com/xz-timeline https://research.swtch.com/xz-timeline : 2024-02-29: On GitHub, @teknoraver sends pull request to stop linking liblzma into libsystemd. It appears that this would have defeated the attack. Kevin Beaumont speculates that knowing this was on the way may have accelerated the attacker’s schedule. @teknoraver commented on HN that the liblzma PR was one in a series of dependency slimming changes for libsystemd; there were two mentions of it in late January. I think that this is a plausible explanation for a rushed schedule and an actually justified deadline.
- eichin 3y ago
  (From the "history may not repeat itself but it sure does rhyme" files: Berkeley releasing a new ftpd with fixes for a bunch of buffer overruns (in Fall of 1988, when this was a New Thing) was widely suspected to be a reason the Morris Worm launched when it did, because some of the holes it used might have gotten closed too. I'm not sure if this ever got confirmed but it was part of the earliest responsible disclosure narratives...)
Twirrim 3y ago
We're within weeks of cut-off for Ubuntu's next LTS, Red Hat 10, etc. Fail to deliver their code upstream in the next few weeks and they'd be out of luck for getting it in to an enterprise distribution for the next 3-4ish years. There's nothing arbitrary about the deadlines, the clock was absolutely ticking.
- jethro_tell 3y ago
  You're not wrong, I'm mostly joking here because its a little funny to think about the bureaucracy of spycraft and malice. Not James bond stuff, no beautiful high value targets getting seduced, its just some guy with ADD that spent about 15 days too many bike shedding and botched a critical deadline.

Some group of coders pissed off because the were rushed into shipping and a middle manager or two that were trying to make an arbitrary deadline blaming it on incompetent devs.

planede 3y ago

From https://research.swtch.com/xz-timeline https://research.swtch.com/xz-timeline : 2024-02-29: On GitHub, @teknoraver sends pull request to stop linking liblzma into libsystemd. It appears that this would have defeated the attack. Kevin Beaumont speculates that knowing this was on the way may have accelerated the attacker’s schedule. @teknoraver commented on HN that the liblzma PR was one in a series of dependency slimming changes for libsystemd; there were two mentions of it in late January. I think that this is a plausible explanation for a rushed schedule and an actually justified deadline.

eichin 3y ago
(From the "history may not repeat itself but it sure does rhyme" files: Berkeley releasing a new ftpd with fixes for a bunch of buffer overruns (in Fall of 1988, when this was a New Thing) was widely suspected to be a reason the Morris Worm launched when it did, because some of the holes it used might have gotten closed too. I'm not sure if this ever got confirmed but it was part of the earliest responsible disclosure narratives...)

Twirrim 3y ago

We're within weeks of cut-off for Ubuntu's next LTS, Red Hat 10, etc. Fail to deliver their code upstream in the next few weeks and they'd be out of luck for getting it in to an enterprise distribution for the next 3-4ish years. There's nothing arbitrary about the deadlines, the clock was absolutely ticking.

jethro_tell 3y ago
You're not wrong, I'm mostly joking here because its a little funny to think about the bureaucracy of spycraft and malice. Not James bond stuff, no beautiful high value targets getting seduced, its just some guy with ADD that spent about 15 days too many bike shedding and botched a critical deadline.