You appeal to trust people and give them the benefit of doubt which is normally a good thing. But is this appropiate here?

If this is a coordinated long-term effort by a state entity, there is no reason to trust the supposed creator of the project, especially given what it was targeting from the start.

> You appeal to trust people and give them the benefit of doubt which is normally a good thing. But is this appropiate here?

Yes.

Without evidence to the contrary there is no reason to believe Lasse has been anything other than genuine so all you're doing is insulting and slandering them out of personal satisfaction.

And conspiratorial witch hunts are actively counter-productive, through that mode of thinking it doesn't take much imagination to figure out you are part of the conspiracy for instance.

The thing is there are two possibilities:

1. An important project has an overburdened / burnt out maintainer, and that project is taken over by a persona who appears to help kindly, but is part of a campaign of a state actor.

2. A state actor is involved in setting up such a project from the start.

The first possibility is not only being an asshole to the original maintainer, but it is also more risky - that original maintainer surely feels responsible for his creation and could ring alarm bells. This is not unlikely because he knows the code. And alarm bells is something that state actors do not like.

The second possibility has the risk of the project not being successful, which would mean a serious investment in resources to fail. But that could be countered by having competent people working on that. And in that case, you don't have any real persons,just account names.

What happened here? I don't know.

I don't think state actors would care one bit about being assholes. Organized crime black hats probably wouldn't either.

The original maintainer has said in the past, before Jia Tan's increased involvement and stepping up as a maintainer, that he couldn't put as much into the project due to mental health and other reasons [1]. Seems to fit possibility number one rather well.

If you suspect that Lasse Collin was somehow in it from the start, that'd mean the actor orchestrated the whole thing about mental health and not being able to keep up with sole maintainership. Why would they even do that if they had the project under their control already?

Of course we don't know what's really been happening with the project recently, or who's behind the backdoor and how. But IMO creating suspicions about the original maintainer's motives based entirely on speculation is also a bit assholey.

edit: [1] https://www.mail-archive.com/[email protected]/msg00567.h...

> Why would they even do that

More layers of obfuscation. For example in order to be able to attribute the backdoor to a different party.

It is of course also possible that Lasse Collins is a nice real person who just has not been able to review this. Maybe he is too ill,or has to care for an ill spouse, or perhaps he is not even alive any more. Who knows him as a person (not just an account name) and knows how he is doing?

That is kinda crazy - state actors don't need to care about that level of obfuscation. From a state's perspective the situation here would be simple - hire a smart & patriotic programmer to spend ~1+ years maintaining an important package, then they slip a backdoor in. There isn't any point in making it more complicated than that.

They don't even need plausible deniability, groups like the NSA have been caught spying on everyone and it doesn't hurt them all that much. The publicity isn't ideal. But it only confirms what we already new - turns out the spies are spying on people! Who knew.

There are probably dozens if not hundreds of this sort of attempt going on right now. I'd assume most don't get caught. Or go undetected for a many years which is good enough enough. If you have government money on the budget, it makes sense to go with large-volume low-effort attempts rather than try some sort of complex good-cop-bad-cop routine.

You're correct about a great many things. State actors do things in broad-daylight, get exposed, and it's no fuss to them at all. But that depends on which "sphere of influence" you live in. Russia and China have made major changes to key parts of their critical infrastructure based on revelations that might only result in a sub-committee in US Congress.

But to establish a significant contributor to a key piece of software, not unlike xz, is an ideal position for a state actor. The developer doesn't even need to know who/why, but they could be financially/ideologically aligned. This is what intelligence officers do. They manage real human assets who exist naturally. But to have someone long-established as an author of a project is the exact type of asset they want. Even if they push the code, people immediately start considering how it could have been done by someone else. Yes, it's conspiratorial/paranoid thinking but there's nothing more paranoid than state intelligence trade craft.

You can imagine all the layers of obfuscation you want, but it doesn't seem necessary to explain what is going on here.

On https://www.mail-archive.com/[email protected]/msg00567.h..., Lasse Collin mentions long-term mental health issues among other things.

would be nice if he'd come out with some statements considering he's still committing to xz as of few hours ago

https://git.tukaani.org/?p=xz.git;a=commit;h=f9cf4c05edd14de...

You mean a statement like this https://tukaani.org/xz-backdoor/

It makes me wonder. Is it possible to develop a robust Open Source ecosystem without destroying the mental health of the contributors? Reading his posting really made me feel for him. There are exceedingly few people who are willing do dedicate themselves to developing critical system in the first place. Now there is the burden of extensively vetting every volunteer contributor who helps out. This does not seem sustainable. Perhaps users of open source need to contribute more resources/money to the software that makes their products possible.

False dichotomy much? It doesn't have to be a motivated state actor pulling the strings from the begging. It could also just be some guy, who decided he didn't care anymore and either wanted to burn something or got paid by someone (possibly a state actor) to do this.

What if the maintainer IS the hacker? Where's the evidence they're two different people? I don't think these things are true but calling into question motivations and asking more questions isn't slander (plus it's written which would make it libel, but it's not that either). We are all affected by this, so these are valid concerns.

The downvotes on this and unwillingness to consider the original maintainer may be malicious is disturbing and doesn't inspire trust in the OSS community.

Downvote me all you want. Your denial of a potential reality reveals how deeply you think.

Recall that the original maintainer had mental health issues and other things that likely led to the perceived need to bring on someone to help maintain xz.

This brings up some integrity questions about you and other people bringing forth accusations in order to make the original maintainer feel pressure to bring on someone else to replace the one that inserted a backdoor after several years of ostensibly legitimate commits.

Hopefully this helps you see that these sorts of accusations are a slippery slope and unproductive. Heck, you could then turnaround and accuse me of doing something nefarious by accusing you.

It's possible that he was intentionally pressured and his mental health made bad or worse by the adversary to increase stress. The adversary would then propose to help them reduce the stress.

It's probably straight out of many playbooks.

Additionally to the guy's above point, replacing him after this incident would complete that play

Actually my solution as outlined on twitter was to enforce non anon commits, and i stated it is a bad idea to replace him, so try again.

And, as stated above, I don't think he's malicious, it's still something that must be considered. Sweeping the possibility away is weird.

I don’t stalk all of your social media posts, so from my perspective I don’t see any of the solutions you’ve posted elsewhere — which brings up a good point to keep in mind: none of us see the complete picture (or can read minds to know what someone else really thinks).

The possibility can be kept in mind and considered even if it isn’t being actively discussed. I think in this case, most people think he is not malicious — and feel that unless new compelling evidence to show otherwise appears, potentially starting a harmful rumor based on speculation is counterproductive.

I'm not starting a harmful rumor. People are asking legitimate questions in order to paint the whole picture. Being gaslit is very weird.

> I don't stalk your socials

I mentioned it because you called my intent into question.

Why are people running cover for the maintainer of a repo that just tried to backdoor sshd when others are asking legitimate questions?

You might not be trying to start a rumor, but other people could when they try to answer the questions from a place of ignorance — if you take a look at the comments on a gist summarizing the backdoor, there are quite a few comments by z-nonymous that seem to be insinuating that other specific GitHub users are complicit in things by looking at their commits in various non-xz repositories.

No one is running cover, just that most information so far points to the original maintainer not knowing that the person brought on to help out had ulterior motives, and likely wasn’t even who they purported to be. If you were running an open source project and facing burnout as the sole maintainer, I’d imagine you’d exercise perfect judgement and do a full background check on the person offering to help? I think many of us would like to believe we’d do better, but the reality is, most of us would have fallen for the same trick. So now imagine having to deal with the fallout not just on the technical side, but also the never-ending questions surrounding your professional reputation that people just keep bring up — sounds like a recipe for depression, possibly even suicidal thoughts.

I am running an open source project. Yes if someone was eager to help and was making changes to things that involved security, I would make them doxx themselves and submit to a background check

Well, good for you being one of the few exceptions who would make everyone submit themselves to a proper background check (presumably also covering the cost) before giving any write/commit access to the repo. That’s more than even most large open source projects do before giving access.

Thanks, but you assume too much. I outlined the circumstances under which i would require a background check, so you might want to reread. any other questions?

As I understand it Jia was contributing things like tests, not making changes that involve “security”. They just turned the commit, and eventual ability to make releases on the xz GitHub after “earning” more trust (+ access to GitHub pages hosted under tukaani domain), into something they could use to insert a backdoor.

No questions. Anyone can become a victim to social engineering — I believe the short answer to your question about all the downvotes is that a lot of people recognize how they could have fallen for something similar, and empathize that Lasse is likely now going through a rather difficult time.

I have no question about the downvotes, bud. You're very verbose. Still not sure why you revived an account you haven't commented with in 6 years just to run cover. I find you to be a highly suspicious individual and I really have nothing more to say to you.

I suppose I think verbose-ness will help people see the other side of things. I think I was also trying to convince myself that you aren’t just into conspiracy theories, but given that you’re now accusing me of being suspicious… :shrug: it did come full circle where in my first comment I said you would start accusing me. I guess neither of us have anything more to say to each other because we are both too locked into our own beliefs.

As for motivation… https://xkcd.com/386/ enough said :)

This person revived an account they haven't touched since 2018 in an attempt to convince ME SPECIFICALLY that there is nothing wrong with the original repo maintainer. They gloss over my arguments, use logical fallacies and are generally antagonistic in a way that is not immediately obvious. You be the judge, dear readers.

At any rate, this person has failed their cause and has actually made me double down on the conspiracy theory :)

I do have a history of going years between comments on social media platforms. The last event that got me actively commenting this much on other platforms was all the Trump discourse.

If I didn’t know any better, I’d say you’re enjoying this spirited conversation ;)

> But is this appropiate here?

Yes, nothing points to the inventor of the format and maintainer for decades has done anything with the format to make it suspect. If so, the recent backdoor wouldn't be needed.

It's good to be skeptic, but don't drag people through the mud without anything to back it up.

If a project targets a high-profile, very security sensitive project like the linux kernel from the start, as the archived tukaani web site linked above shows, it is justified to ask questions.

Also, the exploit shows a high effort, and a high level of competence, and a very obvious willingness to play a long game. These are not circumstances for applying Hanlon's razor.

Are you raising the same concerns and targeting individuals behind all other sensitive projects? No, because that would be insane.

It's weird to have one set of standards to a maintainer since 2009 or so, and different standards for others. This witch hunt is just post-hoc smartassery.

Yes, I think if a project has backdoors and its old maintainers are unable to review them, I am more critical than with normal projects. As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning.

And this is in part because I can not even tell for sure that he even exists. If I had met him a few times in a bar, I would be more inclined to believe he is not involved.

> As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning.

Uh, because it's a compression library?

From the project readme: > XZ Utils provide a general-purpose data-compression library plus 21 command-line tools.

https://git.tukaani.org/?p=xz.git;a=blob;f=README;h=ac812ff1...

I'm inclined to believe that whatever state actor was involved sent a memo to their sockpuppets to do whatever they can to deflect blame away.

See what I did there?

It argues the topic pretty well: xz is unsuitable for long-term archival. The arguments are in-depth and well worded. Do you have any argument to the contrary beyond "sour grapes"?

It's not relevant to the current issue at hand.

If you say "sour grapes", then back down your bold statement or don't say at all.

What are you talking about? Do you understand multiple people use this site?

Also do you mean back up?

Antonio literally used to go around mailing lists asking for lzip support and complaining about xz:

- https://gcc.gnu.org/legacy-ml/gcc/2017-06/msg00044.html

- https://lists.debian.org/debian-devel/2017/06/msg00433.html

Also, https://web.archive.org/web/20190605225651/http://octave.159...

I can understand wanting your project to succeed, it's pretty natural and human, but it's flagrant Antonio had a lot of feels about the uptake of xz compared to lzip, as both are container formats around raw lzma data streams and lzip predates xz by 6 months. His complaint article about xz is literally one of the "Introductory links" of lzip.

> xz is unsuitable for long-term archival

Neither is lzip since it doesn't contain error correction codes. You can add those with an additional file (to any archive) e.g. via par2 but then most of the points in the linked rant become irrelevant.

> That is just technical disagreements and sour grapes

Care to provide some evidence to back this statement?