last day (19 days later) » 

2:15 PM
2
Q: create a minimal XZ-backdoor

DillI'd like to see a minimal example of the XZ backdoor. As I understand it: sshd code is not touched using https://sourceware.org/glibc/wiki/GNU_IFUNC a critical function is replaced So sth like this (does not work yet!) main.c (acting as sshd) #include <stdio.h> void critical_function() { p...

 
@KamilCuk research.swtch.com/xz-script — Enjoy the read, it’s a super interesting hack. And it almost screwed us all over big time.
 
Except there never was any "attacker". Changes were made by a developer with full access to anything. The open source format was the true culprit. "Random unknown Internet people making me free software only have my best interests in mind" is beyond naive.
 
@Lundin Of course there was an attacker. And these things can happen (and have happened!) to closed-source projects as well.
 
@KonradRudolph The point is that in an open source project, nobody necessarily got a clue of who the other contributors are. If some random stranger shows up at my job, works for free and starts to commit code into the internal repo, I'm going to get a tad bit suspicious.
@dbush Still, I fail to see how this could have happened to a commercial product.
 
@Lundin Given that this has repeatedly happened in commercial products via infiltration of software and hardware companies, I am confused by your scepticism. As for “how”: usually by infiltrating the hiring process of a company.
 
2:15 PM
@KonradRudolph But that would be way harder since you need a live person to show up in the flesh and take the risk working as the mole. And also make it seem that they are doing the same work as a whole team programmers. There aren't many James Bond types who have the social skills to pull that off while at the same time being proficient enough in niche technologies not to raise suspicion.
With an open source project you can have one person handling all the interactions without having a clue about technology, while at the same time having a whole team of asocial programmer nerds who perhaps don't even speak English in the background, doing the actual work.
 
@Lundin First off, remote work is a thing; “fake” employees are a fairly widespread problem. And even on-site workers can in practice offload a lot of the work to a background team. This actively happens (though mostly for the purpose of industrial espionage). It’s probably harder to pull off than on OSS projects but it’s far from impossible, and in practice as far as I’m aware there’s no evidence that OSS is more vulnerable to exploits than closed source software and/or commercial software.
Ugh, what the heck: I just noticed my initial comment was edited by somebody other than me to change what it says. Completely unacceptable.
 
@KonradRudolph Similarly, there is no evidence that "this has repeatedly happened in commercial products" either, you are making a whole lot of statements with no sources or references cases to back them. As for remote work, it is a relatively new phenomenon and wasn't nearly as common before Covid 19 as it is now.
@KonradRudolph And I believe mods can nowadays edit out snark instead of just instantly handing out a suspension for CoC violations.
 
It’s fairly well established that this has happened repeatedly … I’ll let you do your own research.
 

  last day (19 days later) »