Re:The xz attack shell script
by breadwinner on Tuesday April 02, 2024 @07:17PM
(#39911898)
Today no one knows what Jia Tan looks like. That means Jia Tan come back as Gary Smith and work on the next exploit. If we knew what he looked like, we could have at least prevented him from coming back.
[ Parent
| on HN ]
Jia Tan might be more than one person.
Re:The xz attack shell script
by breadwinner on Wednesday April 03, 2024 @12:40AM
(#39913650)
Requiring him/her to show their face might have prevented that.
Why? Just have one person show up and everyone else funnel the work through their account.
That's still one named person the police can go after, a good starting point for investigation into the criminal network.
Also, that's still one named person that no one would like to end up being, so that alone acts as a deterrent.
On open source projects you can vet people based on whether you can personally identify them as real people. Moving forward be suspicious of anonymity for core contributions.
Debian does things that way, their developers have to get their key signed by other developers, and a DD who signs someone's key is supposed to check ID. But there's no similar protection for their upstream.
Re:The xz attack shell script
by xcrunner529 on Friday April 05, 2024 @09:05PM
(#39949081)
And using a freaking VPN for everything. Definitely more vetting is needed.