2 ms·
Wrt winning: Open is the least worst way of doing things. With the xz kerfuffle people say "aha! So much for your security now!" when the alternative is someon
by mhh__ 3y ago
Wrt winning: Open is the least worst way of doing things.
With the xz kerfuffle people say "aha! So much for your security now!" when the alternative is someone tampering with code on an unsecured ftp serve i.e. it's the devil you can see
- tcmart14 3y agoFor sure, I think that last part is underestimated but powerful. When the SolarWinds or similar attacks occured, we had to rely on investigation reports put out via PR teams and such about how such an attack occured, what processes missed it, etc. With the xz attack, every step of the attack was out in the open for everyone to analyze. Or at least the vast majority, if there were private emails exchanged between "Jia Tan" and the original maintainer, those we can't recover. But we can see pretty much every other aspect of the attack.