Excellent succinct breakdown of the xz mess, from an OpenBSD developer

Re:Excellent succinct breakdown of the xz mess, from an Open... by deskamess on Friday April 05, 2024 @11:55AM (#39943958)

There really is an exception to every rule. "Do not attribute to malice that which can be adequately explained by neglect, ignorance or incompetence" and then you come across:

> The stage 0 shell snippet looks at first glance like a plausible part of > the poorly readable autoconf/automake tooling.

[ Parent | on HN ]

Re:Excellent succinct breakdown of the xz mess, from an Open... by throwanem on Friday April 05, 2024 @12:38PM (#39944443)

None of those adequately explain these commits. This is no exception to Hanlon's razor.

[ Parent | on HN ]

Re:Excellent succinct breakdown of the xz mess, from an Open... by francescovv on Friday April 05, 2024 @01:23PM (#39944895)

Hanlon's razor is useful to curb one's paranoia, but it is far from being a universal rule.

In fact, malice and incompetence are not necessarily mutually exclusive.

This very incident shows several instances where "Jia Tan" is being arguably incompetent, in addition to being clearly malicious: unintended breakage by adding extra space between "return" and "is_arch_extension_supported"; several redundant checks for `uname` == "Linux"; botched payload, so "test files" had to be replaced, with pretty fishy explanation; rather inefficient/slow GOT parsing, list goes on...

[ Parent | on HN ]

Re:Excellent succinct breakdown of the xz mess, from an Open... by narrator on Friday April 05, 2024 @01:24PM (#39944901)

Hanlon's razor lets every single first degree murderer off the hook, or any other of the many crimes where you have to establish intent to convict.

[ Parent | on HN ]

Re:Excellent succinct breakdown of the xz mess, from an Open... by throwanem on Friday April 05, 2024 @01:34PM (#39945009)

It is a rule-of-thumb heuristic, not a law.

Even if this weren't the case, your claim would remain specious. "Establish intent" and "justify attribution to malice" are the same thing said two ways.

[ Parent | on HN ]

Re:Excellent succinct breakdown of the xz mess, from an Open... by jethro_tell on Friday April 05, 2024 @01:12PM (#39944801)

Also, given the context its clearly malice.

If there was one commit with a stray period that disabled the sandbox, sure, might be a typo.

But the other stuff where they're unpacking specific byte ranges from multiple places in the test files, that's not an accident.

Viewed as a whole, it would be extremely hard to view this as "adequately explained by neglect, ignorance or incompetence"

[ Parent | on HN ]