5 ms·
> It does not plausibly pass for a typo because no typical editing glitch will leave a '.' character there. I would certainly attribute that to a typo if I was
by brenoguim 2y ago
> It does not plausibly pass for a typo because no typical editing glitch will
leave a '.' character there.
I would certainly attribute that to a typo if I was reviewing the code.
- AwaAwa 2y ago> The syntax error is a single period '.' as the first character on an otherwise empty line of C code. I believe the point is that given this context, it could/should not be construed as a typo.
- dpkirchner 2y agoIf you received this patch from someone you trusted, and noticed the period, would you call it a typo or would you assume it is malicious? Or is this just an argument over the use of the word "typo" instead of "mistake"? That wouldn't be very useful, IMO.
- dvh 2y agoVery common if you copy paste (using mouse buffer) from midnight commander text editor or any other editor that highlights trailing spaces as dot.
- lenerdenator 2y agoI take it they're not forcing contributors to lint code, then?
- klyrs 2y agoDoes your linter look for syntax errors in the content of strings? If so, how would you design a unit test meant to capture syntax errors?
- tedunangst 2y agoHave you tried running lint on a configure.ac or CMakeLists.txt file?
- brenoguim 2y agoFor those using editors with mouse, it's very easy to add a character anywhere. Doesn't matter the place.
- ip26 2y agoThe point is that under casual review & in isolation, it's not hard to accept as a typo, but under closer review and knowing what we know now, it's almost certainly part of the attack.
- rany_ 2y agoWe only know it's malicious in hindsight. If I was Lasse (original xz maintainer) I could have easily thought it was an innocent typo and that's the point. If it was more convoluted like zero-width Unicode character or misspelling of variable names, it'll be less plausible IMO.
- NekkoDroid 2y agoThe thing is, if anyone would have actually realized it (other than Jai) it would have been hopefully fixed. Like... no one would just see that and say "well, must have been a typo" and just leaves it.
- rany_ 2y agoYou're missing the years of reputation Jia built so that he'd be given the benefit of the doubt. I don't think anyone would have been too suspicious.
- NekkoDroid 2y agoI am not saying people would have said Jia is acting maliciously, just noone saw this to begin with else it would have been fixed in a separate patch (before the emergancy fix recently by Lasse)
- rany_ 2y agoXZ is just a really boring project. It seems complete for the most part, so I'm not surprised by the lack of scrutiny. It's one of these projects that I would just assume is well maintained.
- ksherlock 2y agoed man! Ed uses a single . line to end input. You actually can't enter a single '.' (because that wound end your input) but "I was using vi and must have dropped into ex mode or something" on the surface sounds reasonable.
- yongjik 2y ago"." repeats the last command in vim, so I'd consider it quite plausible as a typo, if we didn't know about the rest of the stuff.