Hi, guy who discovered the back door here.

The flow was always BitKeeper => CVS, not CVS => BitKeeper.

The only way this change would have made it into BK is if one of the users of CVS tree modified the same area of code and included that change in a patch sent to Linus or one of the other BK users. The chances of that happening and not being caught in review were, in my opinion, zero. Ziltch. Just not possible, any reasonable programmer would have seen this.

To this day I believe this was a script kiddy who broke in and wanted to see if he could stick a trojan in there and get root on machines that installed this code. Seems dicey at best because while some people used the CVS stuff at the time, all the releases were done from BK at that time so that code would have never hit mainstream distros.

Although you might feel motivated to deride the attacker, I think it's safe to say that this person was skilled beyond "script kiddy".

I'm old so maybe the meaning of "script kiddy" has evolved, but back in the day my understanding is that term applied to people who did this sort of thing. Maybe I misunderstand the term, hacking into machines is certainly not my area of expertise.

To my understanding, the meaning of "script kiddie" hasn't changed much over time. It still means:

Someone who breaks into computers by merely executing the scripts and hacking tools written by others, without any coding on their own, and without any deep knowledge about that attack.

See also: https://en.wikipedia.org/wiki/Script_kiddie

OK, so I was wrong. Not sure what to call the person who did the backdoor then (nor why it is a big deal). But whatever, I used the wrong term, sorry.

Anyway luckydue - good spotting in finding it those years ago and thanks for all your effort. As a linux user, I appreciate the effort all the linux hackers make.

The Linux kernel guys are an impressive bunch. I've helped but I'm not in their league. I did BitKeeper to help Linus. He's a great programmer, architect, and manager, and in ~25 years in the industry I've never met another guy with his skill set.

In spite of all the shit I've taken for the choices I have made, I'd do it all over again to help Linus. That guy is unique. I know you guys like him but I think few people really realize how unique he is. He's a big deal, I am not.

What's clever about that code is that the conditional will always fail. The assignment expression setting the uid to 0 will itself evaluate to 0, which will cause the conjunction to evaluate to "false." On first glance, the code makes you believe that the body of the conditional is necessary, when it's in fact dead code. That's nice camouflage.

I like the extra parens in the if condition. It's genius.

On the face of it, it appears that the parens are to ensure correct operator precedence because a bitwise OR is used (a common idiom because bitwise operators have the wrong precedence versus comparison in C).

But that's not what the parens are really for! They are there because gcc complains about assignments inside of conditionals unless you put parens around it.

Also clever is the fact that the first clause acts as a password, so that the backdoor opens only if called with the supposedly invalid option combination.

The hack itself is primitive (I guess most of the obfuscation contest entrants used this trick at least once), but hacking into the official CVS repository looks more suspicious. More so that nobody have noticed/reported this break in.

I think I done this "hack" several times when I started coding and scratched my head for a while before realising I was missing an equality sign!

Hah, that's what make this "hack" so popular - it's very easy to miss, even for seasoned programmers, when just glancing at a code.

I remember this appearing on an exam in my C class back in '89 or so. It was basically "What does this code output...", and had "if (a = 3)" instead of "if (a == 3)". Thing is, I recognized the mistake, and though the instructor made a typo. So I answered based on what I thought the instruct had meant. Of course I got the question wrong. (I was fairly cocky back then, and normally I would have answered the question at face value just to "be that way", but I was trying to break that bad habit and it ended up back-firing on me anyway).