4 ms·

https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor > A subsequent investigation found that the campaign to insert

https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor > A subsequent investigation found that the campaign to insert the backdoor into the XZ Utils project was a culmination of over two years of effort, starting in 2021, by a user going by the name "Jia Tan". They used sock puppetry in a pressure campaign against the original maintainer of XZ Utils, eventually being given maintainer permissions on the project.

dist-epoch 5mo ago
sure. how many cases like these we had so far? 1, 2? and how long did they work to get commit access?
- ceejayoz 5mo ago
  > how many cases like these we had so far? As with clever, careful serial killers, it's tough to count the ones we haven't caught.
  - applfanboysbgon 5mo ago
    It's not that tough. You can get an idea by how many people are being murdered. A successful serial killer results in dead people, and a successful infiltration results in malware being executed. If there are no murdered people with unattributed causes of death, or there are no open-source projects with unattributed causes of malware being shipped, you can conclude there are roughly 0 active serial killers / infiltrators. It's possible there are infiltrators who are still working on long-term infiltration and haven't yet attempted to add any malicious code anywhere, but the point is that in terms of actual attempts, we've seen a single one and it wasn't even successful despite years of prep.
    - ceejayoz 5mo ago
      > You can get an idea by how many people are being murdered. No, we can't, as that happens a lot via non-serial killers. A truly successful serial killer is likely one who hides in that noise. No taunting the cops, distributed geographic locations, random methods, avoiding calling cards, and careful not to leave too many traces. It seems likely that some of the 350k unsolved homicides in the US can be explained this way. > It's possible there are infiltrators who are still working on long-term infiltration and haven't yet attempted to add any malicious code anywhere… Or the code's already there, latent, as it would've been in the XZ case, which got discovered by chance and someone very dedicated to looking into a performance glitch.
      - deleted 5mo ago
        [deleted]
- virtualritz 5mo ago
  We only know how many were discovered. Since we do not know the ratio to undiscovered this "1-2" is meaningless to assess the risk of this sort of attack.
brookst 5mo ago
Can we retire the “seatbelts are useless because they can’t prevent every loss of life” approach to risk mitigation please? If the acceptance criteria is “would prevent every single past instance and every imaginable future instance”, then yes, no mitigation is every sufficient to address any problem in the world, so we might as well give up. But I don’t think that’s the right lens to use.
- ceejayoz 5mo ago
  I'm onboard with this! I just object to the term "fixable".
- pjc50 5mo ago
  That depends on whether it's a issue of accidents or a "you have to get lucky every time, we only have to get lucky once" issue.
  - brookst 5mo ago
    Death only has to get lucky once. Are you going to stop wearing seatbelts?
    - ben_w 5mo ago
      I assume pjc50's quotation is referencing a quote attributed to a terrorist group after they failed to assassinate the UK Prime Minister: https://quoteinvestigator.com/2025/12/08/lucky-always/ https://quoteinvestigator.com/2025/12/08/lucky-always/ You're in control of how much danger of accident you expose yourself to. Nobody is in control of how much danger we are exposed to from other people who are actively trying to do us harm, who will keep going until they get what they're after or are stopped. For most people, seatbelts are the former. Yeah, not perfect, but they reduce risk. For the latter, if you're known to be a seatbelt wearer, the attacker just does something where seatbelts don't matter. Every new AI model introduces new capabilities and competencies, so we're not even sure what the true risk levels are yet for self-exposure in this category. The restrictions on AI may be like seatbelts and speed limits, or they may be like "if you install a 1000 HP turbojet engine in your Honda Civic it will no longer be road legal". And this analogy also includes how the first cars had speed limits set low enough to not risk the horse industry, i.e. we may be too cautious.

dist-epoch 5mo ago

sure. how many cases like these we had so far? 1, 2? and how long did they work to get commit access?

ceejayoz 5mo ago
> how many cases like these we had so far? As with clever, careful serial killers, it's tough to count the ones we haven't caught.
- applfanboysbgon 5mo ago
  It's not that tough. You can get an idea by how many people are being murdered. A successful serial killer results in dead people, and a successful infiltration results in malware being executed. If there are no murdered people with unattributed causes of death, or there are no open-source projects with unattributed causes of malware being shipped, you can conclude there are roughly 0 active serial killers / infiltrators. It's possible there are infiltrators who are still working on long-term infiltration and haven't yet attempted to add any malicious code anywhere, but the point is that in terms of actual attempts, we've seen a single one and it wasn't even successful despite years of prep.
  - ceejayoz 5mo ago
    > You can get an idea by how many people are being murdered. No, we can't, as that happens a lot via non-serial killers. A truly successful serial killer is likely one who hides in that noise. No taunting the cops, distributed geographic locations, random methods, avoiding calling cards, and careful not to leave too many traces. It seems likely that some of the 350k unsolved homicides in the US can be explained this way. > It's possible there are infiltrators who are still working on long-term infiltration and haven't yet attempted to add any malicious code anywhere… Or the code's already there, latent, as it would've been in the XZ case, which got discovered by chance and someone very dedicated to looking into a performance glitch.
    - deleted 5mo ago
      [deleted]
virtualritz 5mo ago
We only know how many were discovered. Since we do not know the ratio to undiscovered this "1-2" is meaningless to assess the risk of this sort of attack.

brookst 5mo ago

Can we retire the “seatbelts are useless because they can’t prevent every loss of life” approach to risk mitigation please? If the acceptance criteria is “would prevent every single past instance and every imaginable future instance”, then yes, no mitigation is every sufficient to address any problem in the world, so we might as well give up. But I don’t think that’s the right lens to use.

ceejayoz 5mo ago
I'm onboard with this! I just object to the term "fixable".
pjc50 5mo ago
That depends on whether it's a issue of accidents or a "you have to get lucky every time, we only have to get lucky once" issue.
- brookst 5mo ago
  Death only has to get lucky once. Are you going to stop wearing seatbelts?
  - ben_w 5mo ago
    I assume pjc50's quotation is referencing a quote attributed to a terrorist group after they failed to assassinate the UK Prime Minister: https://quoteinvestigator.com/2025/12/08/lucky-always/ https://quoteinvestigator.com/2025/12/08/lucky-always/ You're in control of how much danger of accident you expose yourself to. Nobody is in control of how much danger we are exposed to from other people who are actively trying to do us harm, who will keep going until they get what they're after or are stopped. For most people, seatbelts are the former. Yeah, not perfect, but they reduce risk. For the latter, if you're known to be a seatbelt wearer, the attacker just does something where seatbelts don't matter. Every new AI model introduces new capabilities and competencies, so we're not even sure what the true risk levels are yet for self-exposure in this category. The restrictions on AI may be like seatbelts and speed limits, or they may be like "if you install a 1000 HP turbojet engine in your Honda Civic it will no longer be road legal". And this analogy also includes how the first cars had speed limits set low enough to not risk the horse industry, i.e. we may be too cautious.