This is a huge wake up call to OSS maintainers that they need to review code a lot more thoroughly. This is far from the last time we’re going to see this, and it probably wouldn’t have been caught if the attacker hadn’t been sloppy
Nah, I’d say the chap was pretty unsloppy.
Just that we were lucky that someone found it.
It’s a good thing that xz is a type of program that people may want to profile.
But this is an eye opener for people saying that Linux is “secure” (not more secure, but just secure .) because the code has many eyes on it. --> jump to digression.
This confirms my suspicion that we may be affected by the bystander effect, so we actually have less eyes than required for this.
digression:
of course I don’t mean that this makes Linux less secure than Windows. The point that it makes it more secure than Windows/MacOS or other closed source systems is already apparent.
Just that, we can’t consider Linux to be secure (without comparing it to something less secure) as many ppl would, when evangelising Linux.
My point being, tell the whole truth. The newbie that’s taking your advice will thank you for that later on.
The reason I consider this sloppy is because he altered default behavior. Done properly, an injection like this probably could have been done with no change to default behavior, and we’d be even less likely to have gotten lucky.
Looking back we can see all the signs pointing to it, but it still took a lot of getting lucky to find it.
I’ve always considered the “source is open so people can check for vulnerabilities” saying a bit ironic, because I’d bet 99% of us never look, nor could find it if we were looking. The bystander effect is definitely here as we all just assume someone else has audited it.
This is a huge wake up call to OSS maintainers that they need to review code a lot more thoroughly. This is far from the last time we’re going to see this, and it probably wouldn’t have been caught if the attacker hadn’t been sloppy
https://upvote.au/comment/818245
Nah, I’d say the chap was pretty unsloppy.
Just that we were lucky that someone found it.
It’s a good thing that
xzis a type of program that people may want to profile.But this is an eye opener for people saying that Linux is “secure” (not more secure, but just secure .) because the code has many eyes on it. --> jump to digression.
This confirms my suspicion that we may be affected by the bystander effect, so we actually have less eyes than required for this.
digression:
My point being, tell the whole truth. The newbie that’s taking your advice will thank you for that later on.
The reason I consider this sloppy is because he altered default behavior. Done properly, an injection like this probably could have been done with no change to default behavior, and we’d be even less likely to have gotten lucky.
Looking back we can see all the signs pointing to it, but it still took a lot of getting lucky to find it.
I’ve always considered the “source is open so people can check for vulnerabilities” saying a bit ironic, because I’d bet 99% of us never look, nor could find it if we were looking. The bystander effect is definitely here as we all just assume someone else has audited it.
And to have strong and continuous analysis of software bills of materials.