3 ms·

I wonder then, whether the attacker has already started over with a new open source project, or found something else to do. Or was xz only one of multiple targ

I wonder then, whether the attacker has already started over with a new open source project, or found something else to do. Or was xz only one of multiple targets where the overall plan didn't actually fail and an updated backdoor, without the performance issues, will soon be injected again through some other project.

peddling-brink 2y ago
Started over? They’ve certainly been cultivating other unrelated sock puppet accounts that they’ve switched over to.
- Brian_K_White 2y ago
  I thougt I read several years ago, like 10 or 15 even, that they could fingerprint people by communication patterns. Like how you can sometimes recognize an author just by the way they write, just by the text itself. Surely that would be something the current ais could do 100x better? So I wonder if there isn't a business there in scanning anonymous posts to associate them with others to deanonymize them all? You could obviously use an ai to rewrite your text, but I bet there is something there that can still be correlated. Simply avoiding using favorite words and phrases doesn't change the essence of whatever you're saying. I think the concept of sockpuppet is about to get complicated. Really it probably already is. If I can imagine something, someone else has probably already been doing it and countering it, and countering that for a decade.
  - HPsquared 2y ago
    That's a big part of how they caught the Unabomber. Unusual spellings of words and ways of saying things. His brother apparently recognised some of these tics. https://theconversation.com/how-the-unabombers-unique-linguistic-fingerprints-led-to-his-capture-207681#:~:text=For%20example%2C%20the%20Unabomber%20used,they%20were%20never%20widely%20adopted https://theconversation.com/how-the-unabombers-unique-lingui....
rvnx 2y ago
You can see what projects they are following on GitHub (notably rust compiler, some embedded platforms, etc)

peddling-brink 2y ago

Started over? They’ve certainly been cultivating other unrelated sock puppet accounts that they’ve switched over to.

Brian_K_White 2y ago
I thougt I read several years ago, like 10 or 15 even, that they could fingerprint people by communication patterns. Like how you can sometimes recognize an author just by the way they write, just by the text itself. Surely that would be something the current ais could do 100x better? So I wonder if there isn't a business there in scanning anonymous posts to associate them with others to deanonymize them all? You could obviously use an ai to rewrite your text, but I bet there is something there that can still be correlated. Simply avoiding using favorite words and phrases doesn't change the essence of whatever you're saying. I think the concept of sockpuppet is about to get complicated. Really it probably already is. If I can imagine something, someone else has probably already been doing it and countering it, and countering that for a decade.
- HPsquared 2y ago
  That's a big part of how they caught the Unabomber. Unusual spellings of words and ways of saying things. His brother apparently recognised some of these tics. https://theconversation.com/how-the-unabombers-unique-linguistic-fingerprints-led-to-his-capture-207681#:~:text=For%20example%2C%20the%20Unabomber%20used,they%20were%20never%20widely%20adopted https://theconversation.com/how-the-unabombers-unique-lingui....

rvnx 2y ago

You can see what projects they are following on GitHub (notably rust compiler, some embedded platforms, etc)