News for hackers. Stuff that matters.

A comment on Excellent succinct breakdown of the xz mess, from an OpenBSD developer. Parent comment

Re:Excellent succinct breakdown of the xz mess, from an Open... by rany_ on Friday April 05, 2024 @01:10PM (#39944772)
We only know it's malicious in hindsight. If I was Lasse (original xz maintainer) I could have easily thought it was an innocent typo and that's the point. If it was more convoluted like zero-width Unicode character or misspelling of variable names, it'll be less plausible IMO.
[ Parent | on HN ]
Re:Excellent succinct breakdown of the xz mess, from an Open... by NekkoDroid on Friday April 05, 2024 @01:42PM (#39945095)
The thing is, if anyone would have actually realized it (other than Jai) it would have been hopefully fixed. Like... no one would just see that and say "well, must have been a typo" and just leaves it.
[ Parent | on HN ]
Re:Excellent succinct breakdown of the xz mess, from an Open... by rany_ on Friday April 05, 2024 @02:59PM (#39945813)
You're missing the years of reputation Jia built so that he'd be given the benefit of the doubt. I don't think anyone would have been too suspicious.
[ Parent | on HN ]
Re:Excellent succinct breakdown of the xz mess, from an Open... by NekkoDroid on Friday April 05, 2024 @05:40PM (#39947575)
I am not saying people would have said Jia is acting maliciously, just noone saw this to begin with else it would have been fixed in a separate patch (before the emergancy fix recently by Lasse)
[ Parent | on HN ]
Re:Excellent succinct breakdown of the xz mess, from an Open... by rany_ on Friday April 05, 2024 @05:50PM (#39947676)
XZ is just a really boring project. It seems complete for the most part, so I'm not surprised by the lack of scrutiny. It's one of these projects that I would just assume is well maintained.
[ Parent | on HN ]