News for hackers. Stuff that matters.
Re:The Linux Backdoor Attempt of 2003 by phaemon on Wednesday October 09, 2013 @09:23AM (#6521052)
Older versions of git would tell you the hashes were wrong. Implementations of git in other languages would tell you the hashes were wrong. Manually checking would tell you the hashes were wrong. It's just not feasible.

EDIT: Plus, git is stored in git, so you'd need to backdoor git first... ;)

Re:The Linux Backdoor Attempt of 2003 by yuvadam on Wednesday October 09, 2013 @09:46AM (#6521173)
Re:The Linux Backdoor Attempt of 2003 by ryanthejuggler on Wednesday October 09, 2013 @09:59AM (#6521239)
Thanks for the link... I've never read the README before, and it's very entertaining. Now I'm going to have "goddamn idiotic truckload of sh*t" echoing through my head all day
Re:The Linux Backdoor Attempt of 2003 by jzzskijj on Wednesday October 09, 2013 @10:06AM (#6521276)
I read, when the project was introduced, but forgotten it a long time ago. Goddamn Idiotic Truckload of Sh*t Hub, Inc. would make a memorable name for an incorporation.
Re:The Linux Backdoor Attempt of 2003 by jerf on Wednesday October 09, 2013 @09:29AM (#6521078)
Also, the source of git would also reveal a problem when examined. To get around that one starts hypothesizing the sort of globe-spanning conspiracy against which one might as well give up ("well, maybe all my compilers (not just gcc, all of them) are also backdoored to backdoor themselves, and each other if you cross-compile, then backdoor git too...").
Re:The Linux Backdoor Attempt of 2003 by damon_c on Wednesday October 09, 2013 @10:45AM (#6521530)
This summer: One man looked too deeply into the source code of his compilers and didn't like what he found.
Re:The Linux Backdoor Attempt of 2003 by jerf on Wednesday October 09, 2013 @11:04AM (#6521647)
Quickly, damon_c! To Kickstarter!
Re:The Linux Backdoor Attempt of 2003 by TheCraiggers on Wednesday October 09, 2013 @11:05AM (#6521657)
The kernel hasn't always been tracked in git though. How would we know something wasn't added before the source was imported into git?
Re:The Linux Backdoor Attempt of 2003 by Aloha on Wednesday October 09, 2013 @12:50PM (#6522341)
Because before it was tracked by git, it was in bitkeeper, and it was likely in some other system before that.
Re:The Linux Backdoor Attempt of 2003 by TheCraiggers on Wednesday October 09, 2013 @02:31PM (#6522944)
I understand that. But what I don't know are the capabilities of those other, older systems that once tracked the kernel source. Do we have the same assurances there?
Re:The Linux Backdoor Attempt of 2003 by antocv on Thursday October 10, 2013 @03:10AM (#6526130)
Great question.

BitKeeper wasnt as good as git when it comes to changesets and introducing bugs, still it was founded on more social side of changes needing approvals. Before that it was CVS and for that its almost easy to introduce backdoors.