Ugh, that this psyops sockpuppetry may have started or contributed to the maintainer's mental health issues seems like the most depressing part of all this. Maintaining OSS is hard enough.

I hope that one takeaway from this entire situation is that if you're a maintainer and your users are pushing you outside your levels of comfort, that's a reflection on them, not on you - and that it could be reflective of something far, far worse than just their impatience.

If you, as a maintainer, value stability of not only your software but also your own mental health, it is entirely something you can be proud of to resist calls for new features, scope increases, and rapid team additions.

Yeah, that was a hard read. I think it highlights the importance of emotionally distancing yourself from your projects.

It's also interesting because it exploits the current zeitgeist when it comes to maintainers' responsibilities to their users and communities. Personally, I think it puts too much expectation on maintainers' shoulders, especially when they're working for free.

Personally, I think maintainers are doing favors for users, and if they don't like how the project is progressing or not, then too bad. That's not a popular sentiment, though.

No good deed goes unpunished, what a shame.

Probably didn't start them, considering that he already mentioned (long-term) mental health issues in the mailing list discussion in which the (likely) sock puppets started making demands.

But it's hard to see the whole thing helping, and it is some combination of depressing and infuriating. I hope he's doing ok.

You only push after you've established your guy as the likely successor. If this was coordinated it was not the first move.

At first I thought the guy who did this was a lone wolf but now I believe it was indeed state actor. They coordinated and harassed original maintainer into giving them access to the project, basically they hijacked the open source project. The poor guy(the original maintainer) was alone against state actor who was persistent with the goal of hijacking and then backdooring the open source project.

It seems like they were actively looking[0] which open source compression library they can inject with vulnerable code and then exploit and backdoor afterwards.

[0] https://lwn.net/Articles/967763/

Reading that link, it seems like the vulnerability is that a file name gets printed, so you can add terminal control characters in a file name and have it printed.

https://github.com/libarchive/libarchive/pull/1609#issuecomm...

> “Recently I've worked off-list a bit with Jia Tan on XZ Utils and”

> "In 2021, JiaT75 submitted a pull request to the libarchive repository with the title ‘Added error text to warning when untaring with bsdtar’ which seemed legitimate at first glance. "

Seems “Jia” is related to both

> At first I thought the guy who did this was a lone wolf but now I believe it was indeed state actor. They coordinated and harassed original maintainer into giving them access to the project, basically they hijacked the open source project. The poor guy(the original maintainer) was alone against state actor who was persistent with the goal of hijacking and then backdooring the open source project.

It could just as easily be a lone wolf capable of writing in different styles (really not difficult if one spends enough time online, one gets exposed to all sorts of styles) or even just your run of the mill criminal gang.

In fact, "multiaccount" cheating (where a single person has multiple accounts that interact with one another in a favourable manner, e.g. trading for stuff for reduced fees, or letting themselves be killed to pad stats, or expressing opinions leaving the impression of mass support, etc.) has been present in many MMO games for more than a decade. I recall an online game I was really into back in high school, eRepublik, which simulated real world politics, economics and warfare (in a really dumbed down version of course), and multiacounts were especially prevalent in politics, where candidates for election would often be padded by fake groups, or even entire countries being taken over by a gang of real people with like ten accounts each.

The complexity is nothing new. The only indicator this could be a state actor is the long con aspect of it. The attacker(s) were looking into years between starting and actually being able to exploit.

I mean one person can use sock puppet accounts to write emails.

Maybe they weren't all sockpuppets. Here Jigar Kumar was nitpicking Jia Tan's changes:

https://www.mail-archive.com/[email protected]/msg00556.h...

That was not necessary to gain trust. Writing style is different, too. Later when Jia gained commit access he reminds him to merge it.

This looks like a very phony "debate".

I think the most convincing case made about the sock puppets is around account creation dates, and also people disappearing after they get what they need. Like Jigar disappearing after Jia becomes maintainer. Or the guy "misoeater19" who creates his debian bug tracker account to say that his work is totally blocked on needing xz 5.6.1 to be in debian unstable.

Ah, the good ol’ lever of urgency. Urgency frequency smells of deception.

that's precisely what sock puppetry does ... talk/write in a different writing style to make others believe it's different people.

For all we know there is a whole cyber-squadron (or whatever their military units are called) behind Jia Tan and other accounts.

I actually wondered how many packages they harassed until they got access to one such

I'm literally shocked by the conversations in the mail-list, it's blatantly an exploitation of others' kindness.