The xz sshd backdoor rabbithole goes quite a bit deeper

Re:The xz sshd backdoor rabbithole goes quite a bit deeper by orbital-decay on Sunday April 07, 2024 @05:40AM (#39959615)

I would say you put too much faith into military-like organization as well. However, from what I can tell it's usually just ordinary security researchers and devs with dubious morals (some are probably even former cybercriminals) that usually don't even have the need-to-know and aren't necessarily aware of every single aspect of their work. The entire thing is likely compartmentalized to hell.

You can't conjure quality from nothing (especially if it's pure patriotism/jingoism), large organizations are bound to work with mediocrities and dysfunctional processes, geniuses don't scale. (I feel like stating the obvious)

[ Parent | on HN ]

Re:The xz sshd backdoor rabbithole goes quite a bit deeper by DyslexicAtheist on Sunday April 07, 2024 @09:41AM (#39960713)

> it's usually just ordinary security researchers and devs with dubious morals (some are probably even former cybercriminals)

not sure if we should easily judge offsec and the private-public partnership that provides intel and offensive capabilities.

whether they're ex-criminals or must be accused of "dubious morals" would depend whether their clients (or targets) are what one considers the enemy.

and what about the guy who silently works on a "dubious project" patiently for years ... and then, at the right moment, knowingly throws a spanner in the works? aren't they the true hero?

[ Parent | on HN ]