4 ms·

I'm nobody so you have no reason to believe me - but there have indeed been other, very prominent projects targeted in very similar attacks. We're still inside

I'm nobody so you have no reason to believe me - but there have indeed been other, very prominent projects targeted in very similar attacks. We're still inside the responsible disclosure window.. hell, even in the blog post we're commenting on, three JS projects were targeted in failed attempts. That's 4 public projects now..

transpute 2y ago
History may record XZ alongside Spectre/Meltdown as industry turning points for "too wide to see".
sqeaky 2y ago
And xz wasn't the first. Several attempts have been made to put garbage in the kernel.
arp242 2y ago
> three JS projects were targeted in failed attempts. Suspected to be targetted, in a way that seems to have 0% chance of succeeding for almost any project. Which is why nothing happened.
- josephg 2y ago
  > seems to have 0% chance of succeeding for almost any project. Its obviously more than 0% given xz was successfully taken over and backdoored. Even a 5% chance of malicious takeover per project would make the situation pretty worrying given how many well funded, motivated government agencies are out there.
  - arp242 2y ago
    I'm not talking about xz, I'm talking about that OpenJS thing: random people emailing out of the blue "plz gimme maintainer". Entirely different situation. I did quote the "three JS projects were targeted in failed attempts" bit, which should have made that abundantly clear.
    - josephg 2y ago
      Is it a different situation? Seems similar to me, except the examples we know about (the obvious ones) are the low skill examples. If someone played the long game like xz and made some helpful improvements to the project in that time, we wouldn’t know about it. People have also done the same thing (to great effect) on the chrome extension “store” to get all manner of malware into chrome extension updates. “Nobody unsubtle was successful” tells us nothing about the success rate of subtle attackers. It’s like looking at all the dodgy ssh and http requests any host on the internet is connected to and concluding “yep, 0% of low effort script kiddie attacks get through. I’m 100% safe from hackers!”

transpute 2y ago

History may record XZ alongside Spectre/Meltdown as industry turning points for "too wide to see".

sqeaky 2y ago

And xz wasn't the first. Several attempts have been made to put garbage in the kernel.

arp242 2y ago

> three JS projects were targeted in failed attempts. Suspected to be targetted, in a way that seems to have 0% chance of succeeding for almost any project. Which is why nothing happened.

josephg 2y ago
> seems to have 0% chance of succeeding for almost any project. Its obviously more than 0% given xz was successfully taken over and backdoored. Even a 5% chance of malicious takeover per project would make the situation pretty worrying given how many well funded, motivated government agencies are out there.
- arp242 2y ago
  I'm not talking about xz, I'm talking about that OpenJS thing: random people emailing out of the blue "plz gimme maintainer". Entirely different situation. I did quote the "three JS projects were targeted in failed attempts" bit, which should have made that abundantly clear.
  - josephg 2y ago
    Is it a different situation? Seems similar to me, except the examples we know about (the obvious ones) are the low skill examples. If someone played the long game like xz and made some helpful improvements to the project in that time, we wouldn’t know about it. People have also done the same thing (to great effect) on the chrome extension “store” to get all manner of malware into chrome extension updates. “Nobody unsubtle was successful” tells us nothing about the success rate of subtle attackers. It’s like looking at all the dodgy ssh and http requests any host on the internet is connected to and concluding “yep, 0% of low effort script kiddie attacks get through. I’m 100% safe from hackers!”