• BURN@lemmy.world
    link
    fedilink
    arrow-up
    21
    arrow-down
    1
    ·
    7 months ago

    This is a huge wake up call to OSS maintainers that they need to review code a lot more thoroughly. This is far from the last time we’re going to see this, and it probably wouldn’t have been caught if the attacker hadn’t been sloppy

    • ulterno@lemmy.kde.social
      link
      fedilink
      English
      arrow-up
      28
      ·
      edit-2
      7 months ago

      https://upvote.au/comment/818245

      Nah, I’d say the chap was pretty unsloppy.
      Just that we were lucky that someone found it.

      It’s a good thing that xz is a type of program that people may want to profile.

      But this is an eye opener for people saying that Linux is “secure” (not more secure, but just secure .) because the code has many eyes on it. --> jump to digression.

      This confirms my suspicion that we may be affected by the bystander effect, so we actually have less eyes than required for this.


      digression:

      • of course I don’t mean that this makes Linux less secure than Windows. The point that it makes it more secure than Windows/MacOS or other closed source systems is already apparent.
        • Just that, we can’t consider Linux to be secure (without comparing it to something less secure) as many ppl would, when evangelising Linux.

      My point being, tell the whole truth. The newbie that’s taking your advice will thank you for that later on.

      • BURN@lemmy.world
        link
        fedilink
        arrow-up
        16
        arrow-down
        1
        ·
        7 months ago

        The reason I consider this sloppy is because he altered default behavior. Done properly, an injection like this probably could have been done with no change to default behavior, and we’d be even less likely to have gotten lucky.

        Looking back we can see all the signs pointing to it, but it still took a lot of getting lucky to find it.

        I’ve always considered the “source is open so people can check for vulnerabilities” saying a bit ironic, because I’d bet 99% of us never look, nor could find it if we were looking. The bystander effect is definitely here as we all just assume someone else has audited it.

        • ulterno@lemmy.kde.social
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          1
          ·
          7 months ago

          Done properly, an injection like this probably could have been done with no change to default behaviour,

          Interesting.
          So the sloppiness was in the implementation and not the social engineering.
          But then of course, people tend to be not good at both, fooling people and fooling programmers/computers at the same time. In this case, the chap turned out to be better at fooling people than programmers/computers.


          And I am being sloppy for not trying to learn enough about exploits even though I should have a good enough programming base to start it.

      • TheHarpyEagle@lemmy.world
        link
        fedilink
        arrow-up
        5
        ·
        7 months ago

        It’s a rough balance when you’re trying to convince people unfamiliar with the internals (let alone non technical people) to make the switch. Saying “Linux is safe, but not bulletproof” may scare them back to the devil they know even if there’s no greater guarantee of safety there.

        • ulterno@lemmy.kde.social
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          2
          ·
          edit-2
          7 months ago

          Of course, maybe I am being too hard on people by expecting everyone to put more thought into everything they make a decision for. But it is in fact the lack of thought that tends to cause problems in all areas we see nowadays.
          But that’s a topic for somewhere else.


          We can simply go by “Linux is more bulletproof than Windows”; instead of calling it “safe”, which would also be wrong.
          Also with, “Windows will shoot you with intent, Linux might just get some stray shrapnel.”