• Q*Bert Reynolds@sh.itjust.works
    link
    fedilink
    arrow-up
    146
    arrow-down
    1
    ·
    edit-2
    7 months ago

    “Engineers have been circulating an old, famous-among-programmers web comic about how all modern digital infrastructure rests on a project maintained by some random guy in Nebraska. (In their telling, Mr. Freund is the random guy from Nebraska.)”

    That’s not quite right. Lasse Collin is the random guy in Nebraska. Freund is the guy that noticed the whole thing was about to topple.

    • BlueÆther@no.lastname.nz
      link
      fedilink
      arrow-up
      57
      ·
      7 months ago

      and that one guy (Lasse) was burnt out and pressured [by jia?] to step back and let jia be the person that the whole internet infrastructure relied upon

      • NaN@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        48
        arrow-down
        1
        ·
        7 months ago

        Publicly pressured by sock puppets. You can see some rando doing similar in repositories for projects like Avahi.

  • treadful@lemmy.zip
    link
    fedilink
    English
    arrow-up
    54
    arrow-down
    1
    ·
    7 months ago

    I suspect this was just a lucky catch of shit that happens all the time. Supply chain attacks are super scary and effectively impossible to eliminate in modern software development.

      • treadful@lemmy.zip
        link
        fedilink
        English
        arrow-up
        35
        ·
        7 months ago

        It’s almost impossible to spot by people looking directly at the code. I’m honestly surprised this one was discovered at all. People are still trying to deconstruct this exploit to figure out how the RCE worked.

        And supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.

        • Possibly linux@lemmy.zip
          link
          fedilink
          English
          arrow-up
          14
          arrow-down
          1
          ·
          edit-2
          7 months ago

          There are sysadmins that discover a major vulnerabilities though troubleshooting

          The key is the number of people involved

        • Rustmilian@lemmy.world
          link
          fedilink
          English
          arrow-up
          11
          ·
          edit-2
          7 months ago

          People are still trying to deconstruct this exploit to figure out how the RCE worked.

          True, but we do know how it got into xz in the first place. Human error and bad practice, we wouldn’t have to reverse engineer the exploit if xz didn’t allow binary commits all together. It’s a very convoluted exploit with hiding “junk” and using awk and other commands to cut around that junk and combining it creating a payload and executing it. Our reliance on binary blobs is a double edged sword.

          supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.

          Also true, because human error is impossible to snuff out completely, however it can be reduced if companies donated to the projects they use. For example, Microsoft depends on XZ and doesn’t donate them anything. It’s free as in freedom not cost. Foss devs aren’t suppliers, it comes as is. If you want improvements in the software your massive company relies on, then donate, otherwise don’t expect anything, they aren’t your slaves.

            • 4z01235@lemmy.world
              link
              fedilink
              arrow-up
              18
              ·
              7 months ago

              Generate the binaries during test execution from known (version controlled) inputs, plaintext files and things. Don’t check binaries into source control, especially not intentionally corrupt ones that other maintainers and observers don’t know what they may contain.

        • fruitycoder@sh.itjust.works
          link
          fedilink
          arrow-up
          2
          ·
          7 months ago

          Right now the greatest level of supply chain secuirty that I know of is formal verification, source reproducible builds, and full source bootstrapping build systems. There was a neat FPGA bootstrapping proj3ct (the whole toolchain to program the fpga could be built on the FPGA) at last years FOSDEMs conference, and I have to admit the idea of a physically verifiable root of trust is super exciting to me, but also out of reach for 98% of projects (though more possible by the day).

    • rollingflower@lemmy.kde.social
      link
      fedilink
      arrow-up
      107
      arrow-down
      1
      ·
      edit-2
      7 months ago

      “Linux saved itself.”

      • having FOSS code
      • being able to silence all system services to detect that bump
      • being able to run stuff in different ways, without a core system component (with and without systemd, as that backdoor only used data when sshd was started via systemd)
      • having people be perfectionist about performance measurements
      • having devs test upstream code not shipped to normal distros
      • being so good microsoft pays people to work on software for it
        • Entropywins@kbin.social
          link
          fedilink
          arrow-up
          83
          arrow-down
          1
          ·
          7 months ago

          A nerd who was benchmarking their ssh connection saved it…I love everything about that fello

          • a Kendrick fan@lemmy.ml
            link
            fedilink
            arrow-up
            19
            arrow-down
            3
            ·
            7 months ago

            Also, the man has said repeatedly on hackernews that he’s a postgresql developer working at microsoft. I imagine that distinction is important.

            • EdgelDil@lemmy.world
              link
              fedilink
              arrow-up
              27
              arrow-down
              2
              ·
              7 months ago

              And if he was a postgresql dev working on linux but employed by the cheesecake factory it would mean that the cheesecake factory saved linux? or was that rather due to that clever dev, and helped by the platform he worked on?

              • mcc@sh.itjust.works
                link
                fedilink
                arrow-up
                5
                arrow-down
                1
                ·
                7 months ago

                but if cheesecake factory hired him and supported him to make this discovery, you would look at the menu differently.

              • bruhduh@lemmy.world
                link
                fedilink
                arrow-up
                2
                arrow-down
                1
                ·
                edit-2
                7 months ago

                No matter how much you wouldn’t like it, there’s fallacy in your statement, either that single individual singlehandedly saved everyone without community and such, or Linux was saved by everyone, Microsoft included, i mean, going to such lengths in mental gymnastics just to exclude some corporation, albeit evil one, is funny i must say, in my opinion it’s either single individual, or everyone included, no need to specifically exclude someone just because they evil or something, and yes, if cheesecake factory hired someone, they shouldn’t be excluded too

  • psmgx@lemmy.world
    link
    fedilink
    arrow-up
    37
    arrow-down
    12
    ·
    7 months ago

    You’re late to the party NYT.

    Also, dude made a good save. Only arch users got hit lol

    • DumbAceDragon@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      31
      ·
      edit-2
      7 months ago
      1. The hack mainly targeted Debian and fedora

      2. Arch doesn’t directly link openssh to liblzma, so the hack doesn’t affect arch users.

      • Revan343@lemmy.ca
        link
        fedilink
        arrow-up
        7
        ·
        7 months ago

        The hack mainly targeted Debian and fedora

        But on Debian it only shipped on sid. This is the reason for Debians slow as fuck release cycle

    • qaz@lemmy.world
      link
      fedilink
      arrow-up
      26
      ·
      7 months ago

      Arch didn’t patch it with systemd so it didn’t really affect them afaik. It did hit OpenSUSE Tumbleweed users.

    • Disonantezko@lemmy.sdf.org
      link
      fedilink
      arrow-up
      26
      ·
      7 months ago

      Do you know the exploit was detected in Debian Sid? (by a PostgreSQL developer), Arch got the update (with both compromised versions), but because don’t directly link openssh to liblzma (as Debian), and thus this attack vector is not possible.

      Also, other rolling distros also got the compromised versions, maybe: openSUSE Tumbleweed, Endeavour OS, Fedora Rawhide, Slackware -current, etc.

    • seaQueue@lemmy.world
      link
      fedilink
      arrow-up
      6
      ·
      7 months ago

      There was some checking in the exploit to verify that it was being built for a deb or rpm package, it didn’t build for anything else. Also, the way the exploit was loaded at runtime relied on features of systemd that Arch isn’t using. It was a dud on Arch.

      • Possibly linux@lemmy.zip
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        8
        ·
        edit-2
        7 months ago

        And how many people actually use those? Arch got hit the hardest

        Ok that’s a bad joke. The exploit targeted Debian, Ubuntu and RHEL

  • m4@kbin.social
    link
    fedilink
    arrow-up
    8
    ·
    7 months ago

    It felt like it had a bit of sensationalism, which alas is not uncommon in today’s journalism, but can it be too much that a major newspaper like the NYT covering this story can bring indirect attention to the problem of hugely underpaid/no paid people working on (and mantaining) critical FOSS stuff?

    • acockworkorange@mander.xyz
      link
      fedilink
      arrow-up
      5
      ·
      7 months ago

      They did claim his work is “boring to tears” right after saying it was “thankless”. What a condescending piece of shit journalist.