The Linux Backdoor Attempt of 2003

Re:The Linux Backdoor Attempt of 2003 by asveikau on Wednesday October 09, 2013 @03:02PM (#6523125)

I suspect you are taking my comment as a personal insult rather than reading it for the meaning I intended. The point I was trying to make is that the skill involved here was hiding the lines in a large source tree and hiding the history. The actual lines of code are unremarkable, absurdly incorrect when taken in isolation, and not where the clever part of this attack lies. The author of the article is stating it as something else.

See also my reply to cbr where I make essentially your same point: the way to get this past a code review is make it part of a large diff.

[ Parent | on HN ]

Re:The Linux Backdoor Attempt of 2003 by acdha on Thursday October 10, 2013 @10:10AM (#6527771)

It's not so much a personal insult as the common tendency most people have to base decisions on best rather than average performance. This essentially devolves to the Deming/TQM/Toyota/etc. school of management where you focus on making the system tolerate human error rather than hoping your humans consistently perform well.

That said, I do disagree that this is easily detected – I would bet that a significant percentage of C developers would not notice this if it wasn't mentioned in the context of a security problem. Linux kernel developers are [hopefully] well above average but … there's a reason why so many style guidelines feature this one prominently and it's not because few people have made this mistake.

[ Parent | on HN ]