3 ms·
We only know it's malicious in hindsight. If I was Lasse (original xz maintainer) I could have easily thought it was an innocent typo and that's the point. If i
by rany_ 3y ago
We only know it's malicious in hindsight. If I was Lasse (original xz maintainer) I could have easily thought it was an innocent typo and that's the point. If it was more convoluted like zero-width Unicode character or misspelling of variable names, it'll be less plausible IMO.
- NekkoDroid 3y agoThe thing is, if anyone would have actually realized it (other than Jai) it would have been hopefully fixed. Like... no one would just see that and say "well, must have been a typo" and just leaves it.
- rany_ 3y agoYou're missing the years of reputation Jia built so that he'd be given the benefit of the doubt. I don't think anyone would have been too suspicious.
- NekkoDroid 3y agoI am not saying people would have said Jia is acting maliciously, just noone saw this to begin with else it would have been fixed in a separate patch (before the emergancy fix recently by Lasse)
- rany_ 3y agoXZ is just a really boring project. It seems complete for the most part, so I'm not surprised by the lack of scrutiny. It's one of these projects that I would just assume is well maintained.