3 ms·
Why do we assume the person building the trust is the attacker ? Is not possible the attacker simply took over the account of some one genuinely getting involv
by manquer 3y ago
Why do we assume the person building the trust is the attacker ?
Is not possible the attacker simply took over the account of some one genuinely getting involved in the community either hacked or just with $5 wrench and then committed the malicious code ?
- ericpruitt 3y ago> Is not possible the attacker simply took over the account of some one genuinely getting involved in the community either hacked or just with $5 wrench and then committed the malicious code ? Given the behavior of the accounts that applied pressure on the original xz maintainer, this seems unlikely to me.
- ilvez 3y agoOr they just bought the guy at one point, because I understood the malicious behaviour started quite recently.
- timschmidt 3y agoJia Tan's very first commit two years ago made suspicious changes to liblzma. See the timeline here: https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo...