4 ms·

I've now seen four articles in a range of publications using the xz incident to say that same thing about FOSS. Here's one in a defense industry publication: h

I've now seen four articles in a range of publications using the xz incident to say that same thing about FOSS. Here's one in a defense industry publication: https://www.defenseone.com/ideas/2024/04/how-fix-militarys-software-snafu/395489/ https://www.defenseone.com/ideas/2024/04/how-fix-militarys-s... When it appears in diverse multiple places simultaneously, I generally believe someone is coordinating a media campaign. You may think that's paranoid but look at the merits of the argument: how else is it explained? They didn't coincidentally think of the exact same argument, especially when FOSS's reputation has been well-established for a long time - why now, for this particiular vulnerability, are all these people suddenly expressing doubts? And they didn't read each other's articles: these articles need to be thought of, written, edited, and published. You (those reading on HN) needs to push back and point out the absurdity of the argument now. Otherwise, even if it doesn't cause major changes, it will plant a seed - FUD, using the old IBM technique. Next time there's a incident, they will just keep beating that drum, as for-profit companies make another reach for more power. I'm sure others here will point out plenty of flaws in the argument; biggest of all is that proprietary software has the same problems - you can list them with ease. Who is behind it? We may know when the first one says they are discontinuing using FOSS. EDIT: Another reason to think it's coordinated: It's absolute BS. Nobody in IT would seriously make this claim. Everyone uses FOSS one way or another, and everyone has seen plenty of awful proprietary software. It's a deception intended for the uninformed outside IT. Think about it: Many people saying the truth simultaneously makes sense. But for many people to come up with the same BS - and any IT professional is deceiving people knowingly - that takes coordination.

kibwen 3y ago
> I generally believe someone is coordinating a media campaign. You don't need centralized coordination. Companies that sell closed-source software are inherently incentivized to defend their practices and denigrate their competitors. It's not a cabal, it's the systematic perverse incentives created by financial interests.
- wolverine876 3y ago
  Why haven't I seen that argument previously when there were vulnerabilities? Why are all these people suddenly saying it, all at the same time?
  - kibwen 3y ago
    1. Because this wasn't any old vulnerability, this was a backdoor placed there intentionally. 2. Because such attacks are rare (or perhaps rarely noticed), with the previous high-profile one being a backdoor attempt in the kernel in 2003. 3. Because this is the first high-profile open-source backdoor since tensions began to rise WRT cyber warfare with Russia and China.
lesuorac 3y ago
I believe the devils advocate is that one of the 4 articles is an original article and the other three read the first one and wrote their own copy for eyeballs. I do think for the defense and a lot of other industries it would be good for them to buy OSS code through a third-party that actually vetted the versions for bugs and other issues. Like the alternative is each of the defense companies expecting each of their developers to vet each library which is just a colossal wasted of work.
- wolverine876 3y ago
  > I believe the devils advocate is that one of the 4 articles is an original article and the other three read the first one and wrote their own copy for eyeballs. Without being pedantic, what do you think of my counterargument to that point in the GP? (No complaint if you missed it, but let's start from there.)
  - lesuorac 3y ago
    > When it appears in diverse multiple places simultaneously, I generally believe someone is coordinating a media campaign. You may think that's paranoid but look at the merits of the argument: how else is it explained? They didn't coincidentally think of the exact same argument This counterargument? I think my comment still applies. One of them had an original thought and the other copied them. However, on further research I think at least with this article you are correct. The guy works for Chainguard [1] so he has a financial interest in the Iron Bank no longer existing. The guys previous article for Log4J [1] is arguing for public funds to be spent auditing OSS. And given his current work I don't think he's against FOSS; just as long as you get the FOSS through him. [1]: https://www.chainguard.dev/ https://www.chainguard.dev/ [2]: https://www.defenseone.com/ideas/2022/08/military-should-red-team-open-source-code/375635/ https://www.defenseone.com/ideas/2022/08/military-should-red...
    - wolverine876 3y ago
      C'mon, you didn't even read to the end of the paragraph you quoted.

kibwen 3y ago

> I generally believe someone is coordinating a media campaign. You don't need centralized coordination. Companies that sell closed-source software are inherently incentivized to defend their practices and denigrate their competitors. It's not a cabal, it's the systematic perverse incentives created by financial interests.

wolverine876 3y ago
Why haven't I seen that argument previously when there were vulnerabilities? Why are all these people suddenly saying it, all at the same time?
- kibwen 3y ago
  1. Because this wasn't any old vulnerability, this was a backdoor placed there intentionally. 2. Because such attacks are rare (or perhaps rarely noticed), with the previous high-profile one being a backdoor attempt in the kernel in 2003. 3. Because this is the first high-profile open-source backdoor since tensions began to rise WRT cyber warfare with Russia and China.

lesuorac 3y ago

I believe the devils advocate is that one of the 4 articles is an original article and the other three read the first one and wrote their own copy for eyeballs. I do think for the defense and a lot of other industries it would be good for them to buy OSS code through a third-party that actually vetted the versions for bugs and other issues. Like the alternative is each of the defense companies expecting each of their developers to vet each library which is just a colossal wasted of work.

wolverine876 3y ago
> I believe the devils advocate is that one of the 4 articles is an original article and the other three read the first one and wrote their own copy for eyeballs. Without being pedantic, what do you think of my counterargument to that point in the GP? (No complaint if you missed it, but let's start from there.)
- lesuorac 3y ago
  > When it appears in diverse multiple places simultaneously, I generally believe someone is coordinating a media campaign. You may think that's paranoid but look at the merits of the argument: how else is it explained? They didn't coincidentally think of the exact same argument This counterargument? I think my comment still applies. One of them had an original thought and the other copied them. However, on further research I think at least with this article you are correct. The guy works for Chainguard [1] so he has a financial interest in the Iron Bank no longer existing. The guys previous article for Log4J [1] is arguing for public funds to be spent auditing OSS. And given his current work I don't think he's against FOSS; just as long as you get the FOSS through him. [1]: https://www.chainguard.dev/ https://www.chainguard.dev/ [2]: https://www.defenseone.com/ideas/2022/08/military-should-red-team-open-source-code/375635/ https://www.defenseone.com/ideas/2022/08/military-should-red...
  - wolverine876 3y ago
    C'mon, you didn't even read to the end of the paragraph you quoted.