3 ms·

I was referring to the time zone of +8 used in the git commits mentioned here: https://www.wired.com/story/jia-tan-xz-backdoor https://www.wired.com/story/jia-

I was referring to the time zone of +8 used in the git commits mentioned here: https://www.wired.com/story/jia-tan-xz-backdoor https://www.wired.com/story/jia-tan-xz-backdoor The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind The thwarted XZ Utils supply chain attack was years in the making. Now, clues suggest nation-state hackers were behind the persona that inserted the malicious code. ... At a glance, Jia Tan certainly looks East Asian—or is meant to. The time zone of Jia Tan’s commits are UTC+8: That’s China’s time zone, and only an hour off from North Korea’s.

defrost 2y ago
> or is meant to. Indeed. If it's nation state and years in the making then the idea of all the commit times being faked isn't a stretch. Hell, even five-eyes (UK+AU+US+etc) could seek a linux backdoor and use Perth, Australia (GMT+8) timezones or have a submission bot in the UK that just commits at preset time from preset IP proxy.
- throwaway4good 2y ago
  I would guess the guy that maintained the Jia Tan identity was working out of Australia. The time zone is consistent with Western Australia and the work starts by "branching out" a not widely used Australian test framework. The actual attack is probably done by someone else.