Re:XZ Backdoor: Times, damned times, and scams
by asveikau on Sunday March 31, 2024 @10:02PM
(#39890191)
Somebody on another HN thread pointed out he used Gmail, so google has something too.
I think I saw somewhere a claim that somebody confirmed he used a VPN, I'm can't recall how they did that.
Re:XZ Backdoor: Times, damned times, and scams
by cozzyd on Sunday March 31, 2024 @10:45PM
(#39890418)
Anyone try emailing with a tracking image?
Re:XZ Backdoor: Times, damned times, and scams
by jcranmer on Sunday March 31, 2024 @11:15PM
(#39890606)
No need to bother with a tracking image. Just scour the message headers of any message sent in the past--there's decent chance there's a few more dates lurking in those headers, and even an IP address or two.
Re:XZ Backdoor: Times, damned times, and scams
by dustyharddrive on Sunday March 31, 2024 @11:41PM
(#39890718)
Headers have the IP address of their mail service.
Re:XZ Backdoor: Times, damned times, and scams
by asveikau on Sunday March 31, 2024 @11:55PM
(#39890768)
Years ago they would include the IP of the end user. Gmail and hotmail stopped including that more than a decade ago. But they both used to. I think Gmail stopped this practice years ahead of Hotmail.
I have a relative with mental health problems who lives on the street, and he sometimes writes me from public libraries -- kind of luckily for family members who are concerned about him, the webmail service he uses still includes that info in headers. So I usually know which public library he writes from.
Re:XZ Backdoor: Times, damned times, and scams
by cozzyd on Monday April 01, 2024 @12:05AM
(#39890816)
When I was a PhD student ips in header were a great way to see if professors I was working with were traveling or not...
Re:XZ Backdoor: Times, damned times, and scams
by asveikau on Sunday March 31, 2024 @10:49PM
(#39890438)
I'm sure this guy is not checking his email after being exposed.
Re:XZ Backdoor: Times, damned times, and scams
by juliusdavies on Sunday March 31, 2024 @10:16PM
(#39890260)
They refused to divulge how they knew
…What I would really want is some input from Microsoft. I don't know what they can reveal, but I believe they must have quite a bit more data, than us. Even speaking about times, well, he must have been using Github more than to just commit stuff. And I'd imagine they have some logs. Also, it's very fair to assume than he was using VPN all the time, but it's also fair to assume that he wouldn't accidentally slip like that, revealing his real time zone in 9 commits. So, yeah, for sure there are people who have waay more data than me, and probably know how to use it properly better than me too. Not sure they will be willing to share, though.