News for hackers. Stuff that matters.
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by bulatb on Saturday March 30, 2024 @05:01PM (#39878622)
A software project has the features it implements, the capabilities it offers users, and the boundary between itself and the environment in which those features create value for the user by becoming capabilities.

The "accounting" features in the source code may be finished and bug-free, but if the outside world has changed and now the user can't install the software, or it won't run on their system, or it's not compatible with other current software, then the software system doesn't grant the capability "accounting," even though the features are "finished."

Nothing with a boundary is ever finished. Boundaries just keep the outside world from coming in too fast to handle. If you don't maintain them then eventually the system will be overwhelmed and fail, a little at a time, or all at once.

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by asveikau on Saturday March 30, 2024 @05:10PM (#39878698)
I feel like this narrative is especially untrue for things like lzma where the only dependencies are memory and CPU, and written in a stable language like C. I've had similar experiences porting code for things like image formats, audio codecs, etc. where the interface is basically "decode this buffer into another buffer using math". In most cases you can plop that kind of library right in without any maintenance at all, it might be decades old, and it works. The type of maintenance I would expect for that would be around security holes. Once I patched an old library like that to handle the fact that the register keyword was deprecated.
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by pas on Saturday March 30, 2024 @07:44PM (#39879779)
C is not stable, CPU microarchitecture versions are coming from time to time. LZMA compression is not far from trivial. the trade-offs made back then might not be the most useful ones now, hence there are usually things that make sense to change even if the background math will be the same forever.

sure, churn and make believe maintenance for the sake of feeling good is harmful. (and that's where the larger community comes in, distributions, power users, etc. we need to help good maintainers, and push back against bad ones. and yes this is - of course - easier said than done.)

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by bulatb on Saturday March 30, 2024 @09:37PM (#39880530)
Smaller boundaries are likelier to need less maintenance, but nothing stands still. The reason you can run an ancient simple binary on newer systems is that someone has deliberately made that possible. People worked to make sure the environment around its boundary would stay the same instead of drifting randomly away with time—usually so doggedly (and thanklessly) that we can argue whether that stability was really a result of maintenance or just a fact of nature.
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by asveikau on Saturday March 30, 2024 @10:30PM (#39880808)
> The reason you can run an ancient simple binary on newer systems is that someone has deliberately made that possible.

I'm not talking about binaries. I'm talking about C sources. I've done the kind of work you're talking about. You're overestimating it.

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by bulatb on Saturday March 30, 2024 @10:46PM (#39880894)
I must have misread "plop that kind of library" as "plop that kind of binary" about five times. My bad.