News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by omeid2 on Saturday March 30, 2024 @11:08PM (#39881004)
CLA is not an ID check. It is to handover the rights for the code over to the project owners rather than doing any identity check.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by fredamaral on Saturday March 30, 2024 @11:15PM (#39881052)
agreed. but it does not mean i couldn't be. as per the terms, the content of a CLA could be anything. and that's my point
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by creatonez on Saturday March 30, 2024 @11:19PM (#39881078)
That's stretching the traditional definition. Usually CLAs are solely focused on addressing the copyright conditions and intellectual property origin of the contributed changes. Maybe just "contributor agreement" or "contributor contract" would describe that.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by omeid2 on Sunday March 31, 2024 @03:14AM (#39882135)
Then the question becomes "should we require ID for open source contributions?" and the answer is most likely no, not a good idea.
[ Parent | on HN ]