• @recapitated@lemmy.world
    link
    fedilink
    1049 months ago

    The xz infiltration is a proof of concept.

    Anyone who is comforted by the fact they’re not affected by a particular release is misguided. We just don’t yet know the ways in which we are thoroughly screwed.

    • @BURN@lemmy.world
      link
      fedilink
      209 months ago

      This is a huge wake up call to OSS maintainers that they need to review code a lot more thoroughly. This is far from the last time we’re going to see this, and it probably wouldn’t have been caught if the attacker hadn’t been sloppy

      • @ulterno
        link
        English
        27
        edit-2
        9 months ago

        https://upvote.au/comment/818245

        Nah, I’d say the chap was pretty unsloppy.
        Just that we were lucky that someone found it.

        It’s a good thing that xz is a type of program that people may want to profile.

        But this is an eye opener for people saying that Linux is “secure” (not more secure, but just secure .) because the code has many eyes on it. --> jump to digression.

        This confirms my suspicion that we may be affected by the bystander effect, so we actually have less eyes than required for this.


        digression:

        • of course I don’t mean that this makes Linux less secure than Windows. The point that it makes it more secure than Windows/MacOS or other closed source systems is already apparent.
          • Just that, we can’t consider Linux to be secure (without comparing it to something less secure) as many ppl would, when evangelising Linux.

        My point being, tell the whole truth. The newbie that’s taking your advice will thank you for that later on.

        • @BURN@lemmy.world
          link
          fedilink
          159 months ago

          The reason I consider this sloppy is because he altered default behavior. Done properly, an injection like this probably could have been done with no change to default behavior, and we’d be even less likely to have gotten lucky.

          Looking back we can see all the signs pointing to it, but it still took a lot of getting lucky to find it.

          I’ve always considered the “source is open so people can check for vulnerabilities” saying a bit ironic, because I’d bet 99% of us never look, nor could find it if we were looking. The bystander effect is definitely here as we all just assume someone else has audited it.

          • @ulterno
            link
            English
            39 months ago

            Done properly, an injection like this probably could have been done with no change to default behaviour,

            Interesting.
            So the sloppiness was in the implementation and not the social engineering.
            But then of course, people tend to be not good at both, fooling people and fooling programmers/computers at the same time. In this case, the chap turned out to be better at fooling people than programmers/computers.


            And I am being sloppy for not trying to learn enough about exploits even though I should have a good enough programming base to start it.

        • TheHarpyEagle
          link
          fedilink
          59 months ago

          It’s a rough balance when you’re trying to convince people unfamiliar with the internals (let alone non technical people) to make the switch. Saying “Linux is safe, but not bulletproof” may scare them back to the devil they know even if there’s no greater guarantee of safety there.

          • @ulterno
            link
            English
            0
            edit-2
            9 months ago

            Of course, maybe I am being too hard on people by expecting everyone to put more thought into everything they make a decision for. But it is in fact the lack of thought that tends to cause problems in all areas we see nowadays.
            But that’s a topic for somewhere else.


            We can simply go by “Linux is more bulletproof than Windows”; instead of calling it “safe”, which would also be wrong.
            Also with, “Windows will shoot you with intent, Linux might just get some stray shrapnel.”

    • Possibly linux
      link
      fedilink
      English
      69 months ago

      I’m just waiting for the backdoor to be found in Firefox and Chromium or some library shared by most applications.

      • exu
        link
        fedilink
        English
        59 months ago

        Like libwebp a few months back? Or Log4j?

      • @Gabu@lemmy.world
        link
        fedilink
        29 months ago

        The thing about browsers is that there are so many accidental exploits already, it makes little sense to introduce your own on top of it.

    • @GreatDong3000@lemm.ee
      link
      fedilink
      -29 months ago

      I always just assumed all the distros I use have backdoors as a fact of life. I take comfort in not being a person of interest to anyone and just blend in with the crowd. I also don’t use windows because for every backdoor my Debian may have, windows will have 100 more. Servers don’t get hacked all the time because it is not linux->internet, it is linux->bunch of stuff->internet, but I am sure backdoors are there.