Anyone who is comforted by the fact they’re not affected by a particular release is misguided. We just don’t yet know the ways in which we are thoroughly screwed.
This is a huge wake up call to OSS maintainers that they need to review code a lot more thoroughly. This is far from the last time we’re going to see this, and it probably wouldn’t have been caught if the attacker hadn’t been sloppy
Nah, I’d say the chap was pretty unsloppy.
Just that we were lucky that someone found it.
It’s a good thing that xz is a type of program that people may want to profile.
But this is an eye opener for people saying that Linux is “secure” (not more secure, but just secure .) because the code has many eyes on it. --> jump to digression.
This confirms my suspicion that we may be affected by the bystander effect, so we actually have less eyes than required for this.
digression:
of course I don’t mean that this makes Linux less secure than Windows. The point that it makes it more secure than Windows/MacOS or other closed source systems is already apparent.
Just that, we can’t consider Linux to be secure (without comparing it to something less secure) as many ppl would, when evangelising Linux.
My point being, tell the whole truth. The newbie that’s taking your advice will thank you for that later on.
The reason I consider this sloppy is because he altered default behavior. Done properly, an injection like this probably could have been done with no change to default behavior, and we’d be even less likely to have gotten lucky.
Looking back we can see all the signs pointing to it, but it still took a lot of getting lucky to find it.
I’ve always considered the “source is open so people can check for vulnerabilities” saying a bit ironic, because I’d bet 99% of us never look, nor could find it if we were looking. The bystander effect is definitely here as we all just assume someone else has audited it.
Done properly, an injection like this probably could have been done with no change to default behaviour,
Interesting.
So the sloppiness was in the implementation and not the social engineering.
But then of course, people tend to be not good at both, fooling people and fooling programmers/computers at the same time. In this case, the chap turned out to be better at fooling people than programmers/computers.
And I am being sloppy for not trying to learn enough about exploits even though I should have a good enough programming base to start it.
It’s a rough balance when you’re trying to convince people unfamiliar with the internals (let alone non technical people) to make the switch. Saying “Linux is safe, but not bulletproof” may scare them back to the devil they know even if there’s no greater guarantee of safety there.
Of course, maybe I am being too hard on people by expecting everyone to put more thought into everything they make a decision for. But it is in fact the lack of thought that tends to cause problems in all areas we see nowadays.
But that’s a topic for somewhere else.
We can simply go by “Linux is more bulletproof than Windows”; instead of calling it “safe”, which would also be wrong.
Also with, “Windows will shoot you with intent, Linux might just get some stray shrapnel.”
I always just assumed all the distros I use have backdoors as a fact of life. I take comfort in not being a person of interest to anyone and just blend in with the crowd. I also don’t use windows because for every backdoor my Debian may have, windows will have 100 more. Servers don’t get hacked all the time because it is not linux->internet, it is linux->bunch of stuff->internet, but I am sure backdoors are there.
The xz infiltration is a proof of concept.
Anyone who is comforted by the fact they’re not affected by a particular release is misguided. We just don’t yet know the ways in which we are thoroughly screwed.
This is a huge wake up call to OSS maintainers that they need to review code a lot more thoroughly. This is far from the last time we’re going to see this, and it probably wouldn’t have been caught if the attacker hadn’t been sloppy
https://upvote.au/comment/818245
Nah, I’d say the chap was pretty unsloppy.
Just that we were lucky that someone found it.
It’s a good thing that
xzis a type of program that people may want to profile.But this is an eye opener for people saying that Linux is “secure” (not more secure, but just secure .) because the code has many eyes on it. --> jump to digression.
This confirms my suspicion that we may be affected by the bystander effect, so we actually have less eyes than required for this.
digression:
My point being, tell the whole truth. The newbie that’s taking your advice will thank you for that later on.
The reason I consider this sloppy is because he altered default behavior. Done properly, an injection like this probably could have been done with no change to default behavior, and we’d be even less likely to have gotten lucky.
Looking back we can see all the signs pointing to it, but it still took a lot of getting lucky to find it.
I’ve always considered the “source is open so people can check for vulnerabilities” saying a bit ironic, because I’d bet 99% of us never look, nor could find it if we were looking. The bystander effect is definitely here as we all just assume someone else has audited it.
Interesting.
So the sloppiness was in the implementation and not the social engineering.
But then of course, people tend to be not good at both, fooling people and fooling programmers/computers at the same time. In this case, the chap turned out to be better at fooling people than programmers/computers.
And I am being sloppy for not trying to learn enough about exploits even though I should have a good enough programming base to start it.
It’s a rough balance when you’re trying to convince people unfamiliar with the internals (let alone non technical people) to make the switch. Saying “Linux is safe, but not bulletproof” may scare them back to the devil they know even if there’s no greater guarantee of safety there.
Of course, maybe I am being too hard on people by expecting everyone to put more thought into everything they make a decision for. But it is in fact the lack of thought that tends to cause problems in all areas we see nowadays.
But that’s a topic for somewhere else.
We can simply go by “Linux is more bulletproof than Windows”; instead of calling it “safe”, which would also be wrong.
Also with, “Windows will shoot you with intent, Linux might just get some stray shrapnel.”
And to have strong and continuous analysis of software bills of materials.
I’m just waiting for the backdoor to be found in Firefox and Chromium or some library shared by most applications.
Like libwebp a few months back? Or Log4j?
The thing about browsers is that there are so many accidental exploits already, it makes little sense to introduce your own on top of it.
I always just assumed all the distros I use have backdoors as a fact of life. I take comfort in not being a person of interest to anyone and just blend in with the crowd. I also don’t use windows because for every backdoor my Debian may have, windows will have 100 more. Servers don’t get hacked all the time because it is not linux->internet, it is linux->bunch of stuff->internet, but I am sure backdoors are there.