News for hackers. Stuff that matters.

A comment on XZ backdoor story – Initial analysis. Parent comment

Re:XZ backdoor story – Initial analysis by CiPHPerCoder on Saturday April 13, 2024 @12:29AM (#40020501)
I've argued in a blog post [1] that we need to delineate between "open source developer" and "supplier". If we don't do that, calling thankless unpaid volunteers and hobbyists a "supply chain" is kind of insulting [2].

I don't believe that "identity verification" for F/OSS developers is a good idea. Suppliers? Sure. That can be a contract negotiation when you decide how much you pay for it.

Also, I don't think identity verification helps when your adversary is a nation state, which can just falsify government identification if it suits them.

[1] https://scottarc.blog/2024/04/04/open-source-supply-chains-a...

[2] https://crankysec.com/blog/supply/

[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by xcrunner529 on Saturday April 13, 2024 @12:37AM (#40020529)
Just because it can by beaten doesn’t mean making it harder isn’t useful. This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI.
[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by CiPHPerCoder on Saturday April 13, 2024 @12:41AM (#40020546)
> Just because it can by beaten doesn’t mean making it harder isn’t useful.

Fair.

> This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI.

I disagree strongly, and am surprised to hear this argument on Hacker News of all places.

[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by ogurechny on Saturday April 13, 2024 @01:34AM (#40020765)
People are so used to see artificial bureaucratic structures as more real than their real counterparts that they constantly invent such naive solutions. “Just make the gub'ment provide an official paper (with a stamp) that Joe Random Dude is a real developer, a father of two, not a fan of satanic metal music, and the project will be safe”.
[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by xcrunner529 on Sunday April 14, 2024 @01:05AM (#40028797)
People already do this in a general sense for authenticating a person and deciding if they’re trustworthy.
[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by ogurechny on Sunday April 14, 2024 @03:30AM (#40029360)
Not “trustworthy”, but “able to play their role in certain scenes”. When you're outside of that structure, those decorated clothes lose any meaning.
[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by jamespo on Saturday April 13, 2024 @05:07AM (#40021666)
The VPN is just part of the picture (sock puppet accounts complaining about speed of dev, no meaningful history of other contributions from the dev, no trusted "personal network" for the dev, etc) that in hindsight should have raised red flags.
[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by markhahn on Saturday April 13, 2024 @10:59AM (#40023551)
new project idea: OpenBackgroundCheck

volunteer osint researchers attempt to dox any identity you submit, so you can know whether they're the Right Kind of OSS contributor or not.

/s

[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by xcrunner529 on Sunday April 14, 2024 @01:05AM (#40028795)
If they constantly are on a VPN and not willing to disclose a real location or IP then I fail to see why they should be trusted when they don’t provide anything trustworthy themselves.
[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by asveikau on Saturday April 13, 2024 @12:25PM (#40024171)
Most people you interact with electronically, you don't even bother trying to see if they're using a VPN or make any attempt to geolocate them.
[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by xcrunner529 on Sunday April 14, 2024 @01:03AM (#40028789)
Sure but GitHub could have that as a badge to provide useful info that can help with vetting someone who wants to be a maintainer.
[ Parent | on HN ]
Re:XZ backdoor story – Initial analysis by mbs159 on Monday April 15, 2024 @10:08AM (#40040743)
Not everyone dev that uses a VPN or something like Tor is doing so due to some malicious reasons. Some people face challenges regarding privacy.
[ Parent | on HN ]