5 ms·
A stealth attack came close to compromising the Internet
- wjb3 3y ago"This is the Silver Back Gorilla of nerds. The internet final boss." https://twitter.com/vxunderground/status/1774071339671794134 https://twitter.com/vxunderground/status/1774071339671794134
- idiotsecant 3y agoI cringe every time I read this take. This guy is a craftsman, worthy of respect. Hundreds of years ago he'd be making watches or heirlooms or massive bridges and churches. To basically turn him into a parody of a man, like some kind of character in a marvel movie, is gross to me. Calling him a 'nerd' is somewhat dismissive and disrespectful. Call him what he is - a professional.
- lolinder 3y ago> Calling him a 'nerd' is somewhat dismissive and disrespectful. You must have missed that in the 2010s being a nerd became cool. It's not a derogatory term with the younger generations, it's a term of endearment and respect, an identity that is owned and aspired to.
- Dalewyn 3y agoOr to look at it another way, the 2010s were when the people belittled as nerds came into the workforce en masse. Those born in the 80s and 90s and grew up living and breathing computers. The nerds were now in their 20s and 30s, so when the 50s and 60s geezers called them nerds as always the response was "Yeah. I'm a nerd and I'm making money while you're slated for retirement. Problem?" and the term became an identity for those generations. Whatever we're calling the Z-ers today, they will do to us what we did to those who called us nerds.
- lolinder 3y agoWas "nerd" something that was used as an intergenerational label? In my experience (USA) abuse towards "nerds" invariably came from peers, so I don't think it's a question of a generation of nerds growing up—in the generation that entered the workforce in the 2010s nerds were firmly a minority. What I'm seeing is that starting in the mid-2010s the number of high schoolers who identify as nerds has gone up dramatically, to the point where from what I've observed even the popular kids who end up surrounded with their own gang are about as likely to call themselves a nerd and engage in stereotypical nerdy activities as they are to be the football players.
- Dalewyn 3y agoI'd say that's a consequence of the nerd generation entering the workforce. The kids today see the nerds working "cool" jobs at "cool" employers like Microsoft, Google, etc. and become goals to strive to. Granted, that impression is probably on its way out with how much reputation/"cool factor" the tech industry is losing in recent years.
- idiotsecant 3y agoNo, its still disrespectful, but more indidiously and less overtly so. Its a subtle way to 'other' people who do technical work. It carries connotations of being bad at communicating and seeing the 'big picture', having a myopic view of culture, self, and organization. You need only consider the mental images that come up when you consider a 'nerd' vs. a craftsman or an artisan. This man is an artisan.
- lolinder 3y agoNo, I'm not reading this as a way to 'other'—look at this user's other tweets! They're a technical person who from the sound of their content is probably Gen Z. 'Nerd' is used by technically-inclined people in that age group as a term of endearment—it indicates that you're part of their tribe, that they recognize you as one of their own. You can take offense at that because it's not how you think of the word, but that's the way the language has gone.
- opello 3y agoIt seems like it will be the apocryphal take-away given just how frequently the "500ms longer" detail is mentioned. Apocryphal because: > I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. from: https://mastodon.social/@AndresFreundTec/112180406142695845 https://mastodon.social/@AndresFreundTec/112180406142695845
- bink 3y agoI'm not normally the conspiracy type but it would not at all surprise me if someone in a govt. agency was watching this happen but couldn't say anything, so they tipped off someone to sound the alarm.
- r00fus 3y agoSo cliché. I dig the implied respect but it almost reads like a parody of respect.
- johnea 3y agoTypical economist.com view on the world: "This could have been a problem for the world's wealthy!!!" Not that they would ever agreee to any kind of shared support for the free s/w projects that today's internet depends on, because... Elon needs more. Also, I would argue, a good reasson not to be an update apostle. Disable automatic updates, update when you need an updated version of something, or a new vuln directly affects your usage model, not just because an update is available...
- j-wags 3y agohttps://www.economist.com/leaders/2024/04/04/a-chilling-near-miss-shows-how-todays-digital-infrastructure-is-vulnerable https://www.economist.com/leaders/2024/04/04/a-chilling-near... > ... Other fixes are regulatory. America’s cyber strategy, published last year, makes clear that the responsibility for failures should lie not with open-source developers but “the stakeholders most capable of taking action to prevent bad outcomes”. In practice that means governments and tech giants, both of which benefit enormously from free software libraries. Both should expand funding for and co-operation with non-profit institutions, like the Open Source Initiative and the Linux Foundation, which support the open-source ecosystem. The New Responsibility Foundation, a German think-tank, suggests that governments might, for example, allow employees to contribute to open-source software in their spare time and ease laws that criminalise “white hat” or ethical hacking.
- xyst 3y agonon-paywall: https://archive.is/CbRJT https://archive.is/CbRJT
- WarOnPrivacy 3y agoI can't even hit the paywall. The Economist has blocked me for years.
- mypastself 3y agoCan’t wait for the inevitable book on this topic a few years from now, or at least a Darknet Diaries episode before that. I do wonder when they’ll settle on a likely culprit. A few hours ahead of GMT and doesn’t work on Eastern European holidays? There’s probably more work to be done, but just going by the commit history, surely there’s a way to make a more granular assumption, because not all of those countries share all of the same holidays…
- xyst 3y agoI would say the quality of this article is a bit lacking. Offers absolutely nothing new other than speculation from a “widely read” cybersecurity researcher speculating about it being a Russian op. If the original maintainer can work with LEOs, “jia tan” may have left some clues in the “off list” communications. Maybe headers off original emails show a pattern. Maybe even coordinate with Google since the attackers used Gmail accounts. Quite possible an attacker accidentally logged in from a non-sanctioned device or sent email from non state owned device. We are human after all and can make mistakes. Just as the attacker(s) got clumsy towards the end due to patching out loading of unnecessary libraries in systemd
- zakki 3y agoHopefully one of Google's employee dig the gmail record for that accounts. It helps them level the playing field with Microsoft which its employee has found the backdoor.
- xcrunner529 3y agoI feel the XZ dev or at least the US government should subpoena Google for sure.
- cvoss 3y agoWhile the article does present both sides of the classic open source debate ("It's vulnerable because it's open" vs. "It's safe because so many eyes are on it"), it seems to come down on the side of the former. Typical non-software-engineering readers may take away the notion that they should trust open source software less, try to not to rely on it, and become frustrated by the realization that that's almost entirely out of their control as a layperson. But typical software-engineering readers should take away the notion that they, too, should trust open source software less, and, as a solution, rather than withdraw from it, they should become more invested in its thesis of security through the wisdom of crowds. The article quotes someone pooh-poohing "hobbyist" maintainers. But just because something is your hobby doesn't mean you're not a professional at it. Just because you don't get paid for it doesn't mean it's not an incredibly valuable part of your contribution to the good of your neighbors. Keep up the excellent work, everyone. I hope the xz lesson is one that moves us toward the ideal of open source, not away from it.
- zeroCalories 3y agoA crowd is also easy to hide in if it's not actually watching things closely. I expect the actual solution is that we move to sponsored open source, closed contribution projects. No way can we depend on the C equivalent of a random nodejs package for our most important infrastructure.
- deleted 3y ago[deleted]
- mulmen 3y agoHow do you know you can trust the contributors?
- xcrunner529 3y agoNeed to start doing basic verification of identity, being suspicious of users always using a VPn and proving their real location, many many years of contributions before becoming a maintainer and having that control etc.
- Olesya000 3y ago[dead]
- deleted 3y ago[deleted]
- wolverine876 3y agoAnother way to look at it is as part of a major, unremarked change in society: A couple years ago I was talking to someone who came of age since 2016, when I think many of these changes began moving rapidly. When I said something about a community project, they ridiculed the idea that people could and would come together and do good, productive things. I used FOSS as an example, and also of course, democracy. The lack of social trust is a well-known concept, but I don't know if people see the massive change where instead of defaulting to trust, the default is paranoia and also being distrustful - scamming others ('animal spirits', as Jamie Dimon calls them). It's also ridiculing, like my friend, the idea of democracy - for example, the popular notion that doing anything to stand up to power, especially organized protests, is pointless. The briefest glance at history shows otherwise, but of course fact & reason are not the mode of analysis these days. Cui bono? People who have capital and power; people who want to take down the power of the people and democracy. If you look at FOSS from the usual humanistic democratic perspective, with social trust (which is part of human nature, despite attempts to destroy it) - that free people generally do good and well and can self-organize, and that now the Internet provides a way for them to do all that easily - then these big coordinated FOSS projects are a happy thing and make sense. But if you look at it from the current madness, the paranoia and hate, then FOSS becomes suspect. Without social trust, how could such an organization work? Only an organization controlled by a powerful person could acheives something. Think about it: why is the latter type of organization more likely to work than the former?
- wjb3 3y agohttps://finance.yahoo.com/news/1-why-near-miss-cyberattack-151035964.html https://finance.yahoo.com/news/1-why-near-miss-cyberattack-1...