5 ms·

I haven't been following this story super closely but I find it extremely odd that I've heard zero discussion about the perpetrator of this hack.

db48x 3y ago
What’s to discuss? Nothing is known about him.
- chrismartin 3y ago
  There's a lot of metadata about when/how they used git and IRC, and some preliminary analysis on same. Another surname in one of the commits. An apparent LinkedIn account. (See heading "OSINT" in https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... .) A lot of these tracks could be intentionally manipulated by a sophisticated actor to disguise their identity, but it's not "nothing".
  - db48x 3y ago
    Like I said, we don't know anything worth having a real discussion about. Maybe he was in the +03 time zone, and pretending to be in +08, but that's not enough to base a discussion on.
    - qarl 3y ago
      You're discussing it.
      - samus 3y ago
        We are all speculating.
        qarl 3y ago
        So this whole thread is based on the premise that the OP was using the formal definition of "discuss" rather than the informal one? Which is almost certainly not true? Ya'll must be super fun at parties.
        samus 3y ago
        Either kind of discussion is useless since the "evidence" (timezone IDs in strings that are not required to have any relation whatsoever with reality) is flimsy to begin with.
        qarl 3y ago
        LOL. You continue to discuss it.
        samus 3y ago
        We are quite far in a meta-discussion. Even less useful.
        qarl 3y ago
        And... you continue to discuss it. I'm going to stop now. You have quite effectively proven the opposite of your position.
        samus 3y ago
        We have both moved as far from the original topic as possible.
        account42 3y ago
        No you see: you are not allowed to talk about hings if other users think it's unproductive. Cease having fun immediately.
SAI_Peregrinus 3y ago
There's been lots of speculation. It seems likely to be more than one person, likely either a ransomware group or a national intelligence agency.
alecco 3y ago
> However, I believe that he is actually from somewhere in the UTC+02 (winter)/UTC+03 (DST) timezone, which includes Eastern Europe (EET), but also Israel (IST) https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
- Adverblessly 3y ago
  > but also Israel (IST) I had the same thought myself initially, but the analysis suggests a work-week that includes Fri, which precludes Israel (where the work week is Sun-Thu and not Mon-Fri), as well as celebrating Christmas and New Year's which are not official holidays in Israel. It isn't uncommon for younger people to take a day off for New Year's since it is an excuse to party, or for Jews with eastern European origins to celebrate Novy God, but I don't know of any Christmas celebrations. Obviously these could be faked, but then why fake a Mon-Fri work week and not also fake the work hours to match it? To me it seems like an unlikely hypothesis.
  - compsciphd 3y ago
    and I believe someone pointed out that there were commits on yom kippur? that is a day basically no one works. The skies are closed, the roads are empty and everyone is bicycling on all the available streets, including highways.
    - yonatan8070 3y ago
      Israel isn't home only for Jewish people who don't work on Yom Kippur, there are significant populations of both Muslims and Chirstians I don't think that you can rule out any country based on email and commit timestamps, the attacker could have been further east and had a late work day, or further east with an early work day
      - mananaysiempre 3y ago
        I hate to defend Israel’s work week here, because it sucks to an unimaginable extent, but while you’re free not to observe Jewish holidays in Israel, unless you’re lucky to live in one of a handful of places you’ll struggle heavily to get anything done on Fri or Sat. If you try, you’ll find nothing works during most of that time including public transport—except for Friday morning when you’re going to have to scramble to get stuff done so you don’t run out of food before Sunday morning. On Yom Kippur, even driving around in your own car is going to get you fined. And, of course, nearly nothing managed by the governments works on the weekend or holidays, except for the military. (I wouldn’t put it past the intelligence services to keep working during official holidays as a form of obfuscation, mind you. I just wanted to point out that it isn’t as straightforward a deal as Christians—or atheists for that matter—existing: Israel sure makes daily life hard for them.)
sofrimiento 3y ago
I would be interested in semantic analysis of the communication from the involved online personas, similar to what was done for Satoshi, to point to a cultural direction. Would also be interesting to see if there were semantic style differences over time pointing to different people acting as the personas. Since it would be quite a lot of code that has been committed as well, would also be interesting to see if code style differences could be found pointing to more people involved than only one.
- samus 3y ago
  There is nothing of value to gain from such analysis. Even if evidence turns up, it would be even more flimsy than graphology.
  - account42 3y ago
    Since when does does satisfying curiosity not provide any value. This has the potential to be a real life spy story ffs. Yeah you won't know anything for sure, that doesn't make this any less interesting.
- alcover 3y ago
  I fully agree. Stylometry is surprinsingly accurate (as proven on this very forum corpus) and would be quite involved to hide from.
  - ytpete 3y ago
    Has anyone studied yet how well this kind of analysis holds up to simply asking GPT to rephrase your words? The whole thing goes out the window if that kind of attack works nowadays.

db48x 3y ago

What’s to discuss? Nothing is known about him.

chrismartin 3y ago
There's a lot of metadata about when/how they used git and IRC, and some preliminary analysis on same. Another surname in one of the commits. An apparent LinkedIn account. (See heading "OSINT" in https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... .) A lot of these tracks could be intentionally manipulated by a sophisticated actor to disguise their identity, but it's not "nothing".
- db48x 3y ago
  Like I said, we don't know anything worth having a real discussion about. Maybe he was in the +03 time zone, and pretending to be in +08, but that's not enough to base a discussion on.
  - qarl 3y ago
    You're discussing it.
    - samus 3y ago
      We are all speculating.
      - qarl 3y ago
        So this whole thread is based on the premise that the OP was using the formal definition of "discuss" rather than the informal one? Which is almost certainly not true? Ya'll must be super fun at parties.
        samus 3y ago
        Either kind of discussion is useless since the "evidence" (timezone IDs in strings that are not required to have any relation whatsoever with reality) is flimsy to begin with.
        qarl 3y ago
        LOL. You continue to discuss it.
        samus 3y ago
        We are quite far in a meta-discussion. Even less useful.
        qarl 3y ago
        And... you continue to discuss it. I'm going to stop now. You have quite effectively proven the opposite of your position.
        samus 3y ago
        We have both moved as far from the original topic as possible.
        account42 3y ago
        No you see: you are not allowed to talk about hings if other users think it's unproductive. Cease having fun immediately.

SAI_Peregrinus 3y ago

There's been lots of speculation. It seems likely to be more than one person, likely either a ransomware group or a national intelligence agency.

alecco 3y ago

> However, I believe that he is actually from somewhere in the UTC+02 (winter)/UTC+03 (DST) timezone, which includes Eastern Europe (EET), but also Israel (IST) https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...

Adverblessly 3y ago
> but also Israel (IST) I had the same thought myself initially, but the analysis suggests a work-week that includes Fri, which precludes Israel (where the work week is Sun-Thu and not Mon-Fri), as well as celebrating Christmas and New Year's which are not official holidays in Israel. It isn't uncommon for younger people to take a day off for New Year's since it is an excuse to party, or for Jews with eastern European origins to celebrate Novy God, but I don't know of any Christmas celebrations. Obviously these could be faked, but then why fake a Mon-Fri work week and not also fake the work hours to match it? To me it seems like an unlikely hypothesis.
- compsciphd 3y ago
  and I believe someone pointed out that there were commits on yom kippur? that is a day basically no one works. The skies are closed, the roads are empty and everyone is bicycling on all the available streets, including highways.
  - yonatan8070 3y ago
    Israel isn't home only for Jewish people who don't work on Yom Kippur, there are significant populations of both Muslims and Chirstians I don't think that you can rule out any country based on email and commit timestamps, the attacker could have been further east and had a late work day, or further east with an early work day
    - mananaysiempre 3y ago
      I hate to defend Israel’s work week here, because it sucks to an unimaginable extent, but while you’re free not to observe Jewish holidays in Israel, unless you’re lucky to live in one of a handful of places you’ll struggle heavily to get anything done on Fri or Sat. If you try, you’ll find nothing works during most of that time including public transport—except for Friday morning when you’re going to have to scramble to get stuff done so you don’t run out of food before Sunday morning. On Yom Kippur, even driving around in your own car is going to get you fined. And, of course, nearly nothing managed by the governments works on the weekend or holidays, except for the military. (I wouldn’t put it past the intelligence services to keep working during official holidays as a form of obfuscation, mind you. I just wanted to point out that it isn’t as straightforward a deal as Christians—or atheists for that matter—existing: Israel sure makes daily life hard for them.)

sofrimiento 3y ago

I would be interested in semantic analysis of the communication from the involved online personas, similar to what was done for Satoshi, to point to a cultural direction. Would also be interesting to see if there were semantic style differences over time pointing to different people acting as the personas. Since it would be quite a lot of code that has been committed as well, would also be interesting to see if code style differences could be found pointing to more people involved than only one.

samus 3y ago
There is nothing of value to gain from such analysis. Even if evidence turns up, it would be even more flimsy than graphology.
- account42 3y ago
  Since when does does satisfying curiosity not provide any value. This has the potential to be a real life spy story ffs. Yeah you won't know anything for sure, that doesn't make this any less interesting.
alcover 3y ago
I fully agree. Stylometry is surprinsingly accurate (as proven on this very forum corpus) and would be quite involved to hide from.
- ytpete 3y ago
  Has anyone studied yet how well this kind of analysis holds up to simply asking GPT to rephrase your words? The whole thing goes out the window if that kind of attack works nowadays.