XZ: Repo maintainer Lasse Collin responding on LKML

https://lkml.org/lkml/2024/3/30/188

by oger • 2 years ago

141 71 2 years ago

lkml.org

oger• 2 years ago

Signs of life from Lasse and a link to his web containing more information: https://tukaani.org/xz-backdoor/

thinkingemote2• 2 years ago

Doesn't give much more information except that he wasn't immediately picked up by LEO.

Poor guy will go through more stress now even more than that created and imposed on him over 2 years by the attacker.

If anything we should encourage him to look back at his mental health as not being his fault and that we need to protect ourselves.

chgs2• 2 years ago

he wasn't immediately picked up by LEO.

For what?

Jonnax• 2 years ago

Some people are trying to push a conspiracy theory that the maintainer and the contributor are the same person.

2OEH8eoCRo0• 2 years ago

Questioning?

junon• 2 years ago

Lasse has been active and answering questions on IRC over the last day or so. He says he'll be sharing more information on the XZ site in the days or weeks to come.

He's doing fine, by the way, and mentions that the messages of support are appreciated but not necessary.

He's more focused now on figuring out what happened, how he missed it, and deciding a plan of action for cleaning things up.

(paraphrasing from conversations in the public channels)

skrebbel• 2 years ago

Points for Collin for letting his holiday take precedence over this mess.

Don’t forget that he made xz for free, as a hobby project, and likely got duped by “Jia Tan” same as everybody else did. He’s not obligated to solve this on any particular timeline.

Xz is not a business, so if your business got in trouble because a single solo hobby dev was a bit too trustful, it’s your job, and not his, to mitigate the problem.

bayindirh3• 2 years ago

Obligatory XKCD: https://xkcd.com/2347/

Also, I'm on the same page with you. Block the malicious actor, continue sipping your coffee.

JdeBP• 2 years ago

I've said before, elsewhere, that I think that that cartoon is misleading. The truth, as should be apparent nowadays after the parade of leftpad, ntpd, xz, et al., is that there are thousands of those little blocks at the bottom that have a bus factor of 1 volunteer. There aren't any big long base blocks at all. And sometimes the little blocks seem as if they have been set up by domino topplers. (-:

michelsedgh6• 2 years ago

I understand what you are saying and for open source community to have a good reputation and keep its standards high, these important packages have to start being actually maintained by the enterprises that depend on these. Most of businesses use Linux for their servers mainly Ubuntu/Debian and its just crazy for them to be vulnerable in such ways. Imagine how many other places backdoors can be installed even right now, and many of them won’t be visible and wont have performance issues like this one. 0.5s is a big deal in software and if it was 50ms or 5ms no one would have known this possibly for years. I wonder how safe the software we use actually is.

ctrw3• 2 years ago

If you want professional developers pay professional rates. A doctor asks for a hundred bucks for 15 min.

madeofpalk2• 2 years ago

What are you actually proposing here? Any Ubuntu/Debian distribution contains hundreds or thousands of packages and transitive dependencies - it's unreasonable to expect corporations to contribute, even financially, to all of these.

This is supposed to be what services such as Tidelift provide - companies pay them, and OSS maintainers sign up with them for funding (and other support? unsure). But it's tough to apply this through the whole OSS ecosystem. To me, this should be what Canonical's support contracts should be for. They're perfectly positioned to help mediate these types of issues.

npteljes• 2 years ago

The software we use is not safe at all. If we don't have an idea what goes on in an open source projects, how could we even begin to know what goes on in a proprietary binary, or a service? People's dealings operate on trust, that's how, and trust can and will be abused, simple as that.

Most of businesses use Linux for their servers mainly Ubuntu/Debian

Businesses should calculate with the risks, and also, use Long Term Support versions of software, not unstable bleeding edge fresh from the oven ones. Which they do. And so they were not vulnerable at all.

bdd8f1df777b• 2 years ago

Well, I'm certain Facebook would be glad if xz is replaced everywhere by zstd which they maintain. You can't force them to pay for xz when they already maintain a replacement.

cmiles742• 2 years ago

These open source projects have a good reputation and high standards because the developers freely volunteering their time care about the project. Forcing these developers to give their projects to Big Corp may not be the big improvement you are imagining.

Software may have backdoors, I'm not convinced this couldn't have happened if a large company was managing the product. AFAICT, open source software has a better security track record, in general.

IMHO, if it is anyone's job to look for and prevent these kinds of backdoors, it's probably companies like RedHat and Canonical. They bundle the tools with their products and they charge money for support.

fmajid4• 2 years ago

It's not the maintenance of the projects the enterprises have to fund (though that is certainly welcome if the mantainers are willing) but the slow, painful work of vetting the code.

Google does that with Project Zero but few companies are wealthy enough to afford that. The way out is economic, not technical: insurance, and mutualizing the cost of security audits. I wrote up my ideas on the subject here:

https://blog.majid.info/supply-chain-vetting/

xign3• 2 years ago

I'm sorry but no. If you are responsible for the worst backdoor in recent computing history (which is probably a criminal act in nature), then you do have a responsibility to explain what went down. Maybe he can take a couple days to write it but I think more than that would be irresponsible. Collin is partially responsible because he gave the keys to Jia Tan. I don't want to burn him at the stake since he's a victim too but I think it's reasonable to expect him to help clean up this mess and at least help us fill in the gaps and understand what happened.

Think about it this way. Say you are volunteering for a non-profit. You obviously don't have to do it and could just chill at home instead. But once you have agreed to say take a volunteer shift on Saturday, you are obligated to show up. Obviously no one can really stop you from skipping, but it would look bad on you and may get you banned from the non-profit. Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients. If you accidentally set the building on fire which ends up killing 5 people, I would also assume you would help in some fashion to clean up.

Just because you are doing things for free does not mean you don't have social responsibility for your actions. You don't have to work, but just saying "oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that). Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology.

Just want to point out that this isn't a typical "demand underpaid open source developers to work 24/7" issue here. This is a unique circumstance where his action has directly resulted in this happening. I feel bad for him being guilt-tripped to add a maintainer after reading through the old threads two years ago, and as I said I don't want to burn him at the stake, just saying that saying he has no responsibility to help at all is really a bad take.

AtlasBarfed• 2 years ago

Nope.

Dissect "worst backdoor EVAR". Why is it bad?

Is it because thousands of companies and millions of users depend on it?

On one guy on holiday working for free!

When we are essentially in two cold wars currently with ICBM nuclear powers?

Linux is the battleground of cyber warfare, which is being funded by nations probably in the hundreds of billions of dollars. A trillion dollars or more of economic activity runs on it

Windows? Come on, even buggier and less secure, and far less transparent.

Monetary support of Linux maintainers is now a national security concern. You can't have hundred billions for attack and zero dollars for defense, that is a stupid strategy.

utrack• 2 years ago

I won't say it's the worst one (assuming the attacker's private key is not public), just one of the most interesting ones in regards to the social engineering, pressure applied, code hidden in the test files etc.

I would say it's definitely the most interesting one we know about so far :)

allarm3• 2 years ago

...non-profit... no one can really stop you from skipping, but it would look bad on you

No it won't. Unless you have obligations.

Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients.

That's unrelated, to say the least. You obviously shouldn't steal from anyone nor beat up anyone, that's not related to this specific case at all.

Just because you are doing things for free does not mean you don't have social responsibility for your actions.

No. No one forced the society to use the work that somebody was doing for free. And if society decided that it's fine to use it, it's on the society to take the associated risks. Everything else is a good will of the maintainer.

ptx• 2 years ago

Some important context here is that Lasse Collin posted the LKML message and the web page on Saturday the 30th, so while the topmost comment argues that he had no obligation to respond promptly, he nevertheless did respond promptly.

grayhatter• 2 years ago

has no responsibility to help at all is really a bad take.

He has no responsibility to help at all.

All of the work done is that of a donation. Everyone who used xz did so for their benefit. Collin may feel a personal duty to work in the interests of the users of xz, but that's their exclusive choice. Any claim otherwise is on par with saying required-donation.

"oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that).

Then why mention it at all? But even if you did want to say that, that's true! You don't blame the victim of some abuse. Everyone, you included (assuming you use xz in anyway) were lied to. Just because Collin was lied to first, and most, doesn't change the fact the person who did all of the important work was also lied to and betrayed.

Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology.

Personally I'd be neither pissed, nor would I expect an apology. Shitty people are gonna be shit. But your mistake is blaming Collin for 'introducing' you to the person that slapped you in the face. But you're arguing as if Collin should have known this guy was a shitbag, and should hold the icepack while you berate them for making the mistake of trying to help other people... wtf?!

This us vs ourselves toxicity needs to stop. It's not us vs us. It's not even us vs the them. It's us vs the problem, us vs the malicious. The person writing the code is the good guy here.

klausa• 2 years ago

This post it timestamped March 30, which is "just" three days ago; but in this case is _over_ three days ago.

seba_dos1• 2 years ago

It's the mail from Saturday, why would you post it now as if it was new? It was already discussed to death here.

alecco• 2 years ago

Already discussed 2 days ago

https://news.ycombinator.com/item?id=39874466

em-bee3• 2 years ago

the discussion here is very different from previous discussions because it focuses on the role of the maintainer and not the incident itself. so no, we haven't already discussed this.

richdodd• 2 years ago

Posting in support of Collin. I'm sorry this happened to you, and thanks for your hard and thankless work!!

XZ: Repo maintainer Lasse Collin responding on LKML

Related Stories