Technologist vs spy: the xz backdoor debate
lcamtuf.substack.com
Well — we just witnessed one of the most daring infosec capers of my career. Here’s what we know so far: some time ago, an unknown party evidently noticed that liblzma (aka xz) — a relatively obscure open-source compression library — was a dependency of

Thought this was a good read exploring some how the “how and why” including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

  • lemmyreader@lemmy.mlEnglish
    0·
    7 months ago

    “Paid for by a state actor” Yes, who knows.

    • Could be a lone “black hat” or a group of “black hats”. Who knows.

    • Could be the result of a lot of public criticism in the news regarding Pegasus spyware. Who knows.

    • Could be paid by companies without any state actors involved. Who knows.

    • Could be a lone programmer who wants power or is seeking revenge for some heated mailing list discussion. Who knows.

    The question of trust has been mentioned in this case of a sole maintainer with health problems. What I asked myself is : How did this trust develop years ago ? People trusted Linus Torvalds and used the Linux kernel to build Linux distributions with to the point that the Linux kernel became from a tiny hobby thing a giant project. At some point compiling from source code became less fashionable and most people downloaded and installed binaries. New projects started and instead of tar and gzip things like xz and zstd were embraced. When do you trust a person or a project, and who else gets on board of a project ? Nowadays something like :

    curl -sSL https://yadayada-flintstones-revival.com | bash

    is considered perfectly normal as the default installation of some software. Open source software is cool and has kind of produced a sort of revolution in technology but there is still a lot of work to do.

    • agent_flounder@lemmy.worldEnglish
      0·
      7 months ago

      Some of the trust comes from eyes on the project thanks to it being open source. This thing got discovered, after all. Not right away, sure, but before it spread everywhere. Same question of trust applies to commercial software too.

      Ideally, PR reviews help with this but smaller projects esp with few contributors may not do much of that. I doubt anyone has spent time understanding the software supply chain (SSC) attack surface of their product but that seems like a good next step. Someone needs to write a tool that scans the SSC repos and flags certain measures like the # of maintainers.

      PS: I have the worst allergies I’ve had in ages today and my brain is in a histamine fog so maybe I shouldn’t be trying to think about this stuff right now lol cough uuugh blows nose