News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by guenthert on Sunday March 31, 2024 @04:34AM (#39882501)
Hmmh, brings up the question, if no exploit actually occurred, was a crime committed? Can't the authors claim that they were testing how quickly the community of a thousand eyes would react, you know, for science?
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by NekkoDroid on Sunday March 31, 2024 @04:43AM (#39882540)
That's like asking if someone that went into a crowded place with a full-automatic and started shooting at people but "purposefully missing" is just testing how fast law enforcement reacts, you know, for science.

After something like 2 years of planning this out and targeted changes this isn't something "just done for science".

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by guenthert on Sunday March 31, 2024 @10:59AM (#39884858)
Or is it rather like someone posting a video on youtube on how to pick a common lock?

And what's about the fellows of U of Minnesota?

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tempay on Sunday March 31, 2024 @01:18PM (#39886067)
It’s more analogous to getting hired at the lock company and sabotaging the locks you assemble to be trivially pickible if you know the right trick.

The University of Minnesota case is an interesting one to compare to. I could imagine them being criminally liable but being given a lenient punishment. I wonder if the law will end up being amended to better cover this, if it isn’t already explicitly illegal.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by brokenmachine on Monday April 01, 2024 @11:04PM (#39901981)
What happened at the University of Minnesota?
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tempay on Tuesday April 02, 2024 @02:47AM (#39903012)
They intentionally tried to contribute security bugs into the linux kernel as a research project: https://lwn.net/Articles/854645/
[ Parent | on HN ]