• oce 🐆@jlai.lu
    link
    fedilink
    arrow-up
    51
    arrow-down
    1
    ·
    edit-2
    7 months ago

    The malicious changes were submitted by JiaT75, one of the two main xz Utils developers with years of contributions to the project.

    “Given the activity over several weeks, the committer is either directly involved or there was some quite severe compromise of their system,” Freund wrote. “Unfortunately the latter looks like the less likely explanation, given they communicated on various lists about the ‘fixes’” provided in recent updates. Those updates and fixes can be found here, here, here, and here. https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/

    That really sucks. This kind of thing can make people and companies lose trust in open source. I wonder if we will learn the reason behind that. I would guess the developer was paid a lot of money by some organization to risk ruining his reputation like that.

    • sep@lemmy.world
      link
      fedilink
      arrow-up
      52
      ·
      7 months ago

      Like the exact same thing can not happen in a closed source codebase. It probably does daily. Since closed codebases the due dilligence and reviews cost money, and nobody can see the state. They are intentionally neglected.
      Open source nor closed source is immune to the 5$ wrench hack

      • bier@feddit.nl
        link
        fedilink
        arrow-up
        8
        ·
        7 months ago

        Exactly, if you are as big a Microsoft, you can’t tell 100% if one of your developer’s is actually being paid by a foreign government. Even if you say completely check the commits other devs make, there will still be deadlines when a code review is just “looks fine, next”.

    • Wooki@lemmy.world
      link
      fedilink
      arrow-up
      49
      arrow-down
      1
      ·
      edit-2
      7 months ago

      No, its the exact opposite.

      Supply chain conpromise is a level of risk to manage not unique to FOSS. Ever heard of sunburst? It resulted in a lot of Microsofts cloud customers getting wreaked all because their supply chain was compromised.

      Do people continue to buy into 365 and Azure? Yes. Without care.

      So will this hurt open source projects? Not at all, in fact it will benefit them, highlight just why source code SHOULD be open source and visible to all! We would have had very little to no visibility and capability to monitor closed source. Let alone learn, improve and harden how projects can protect against this increasingly more common attack.

        • PainInTheAES@lemmy.world
          link
          fedilink
          arrow-up
          5
          ·
          7 months ago

          Sorry I should have been more clear too. I was trying to convey that the dev could have been paid off/threatened or it could be the work of a state actor or team of state actors under an alias. In one case they could care about their reputation but in the other maybe not.

          • communism@lemmy.ml
            link
            fedilink
            arrow-up
            1
            ·
            7 months ago

            By the sounds of it it was an organised social engineering attack. Almost certainly “Jia Tan” is not a real person, or if it is a real person then it’s a case of stolen identity. Even if I were being threatened to put a backdoor in some software I wouldn’t do it under my real name.