boehs

While it’s not great to provide a UI library but not give developers all of the UI components, theoretically you could implement this yourself — so it’s the least of your concerns: https://boehs.org/node/private-apis

Please read this email [0] from the original author of xz. Try take his perspective in his described situation. I also recommend this summary [1]. [0] https://www.mail-archive.com/[email protected]/msg00567.html [1] https://boehs.org/node/everything-i-know-about-the-xz-backdoor

My takeaways: First from the article itself: >"At this point Lasse seems to have started working even more closely with Jia Tan. Evan Boehs observes that Jigar Kumar and Dennis Ens both had nameNNN@mailhost email addresses that never appeared elsewhere on the internet, nor again in xz-devel." That is an important observation! Takeaway: Most non-agenda driven actual people on the Internet, leave a trail -- an actual trail of social media and other posts (and connected friends) that could be independently verified by system/social media/website administrators via voice or video calls (as opposed to CAPTCHA or other computer-based "Is it a human?" tests, which can be gamed) for stronger confidences in the identity / trustworthiness of the remote individual at the other end of a given account... Next takeaway from the linked article: (https://boehs.org/node/everything-i-know-about-the-xz-backdoor): >"AndresFreundTec @[email protected] writes: Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates." Takeaway: We could always use more observability of where exactly CPU time is spent in given programs... Binaries without symbol tables (which is the majority…

GMT+8, the name (Mandarin/mixed-dialect first name + Hokkien surname) and most importantly the circumstance that the user was seen connecting from a likely VPN exit or hosted server in Singapore [1] are all consistent with a Singaporean identity, whether real or cover. For that reason, the opinion of [1]'s source that the name sounds fake should also be taken with some amount of salt (Mainland Chinese are not always well-informed about Diaspora Chinese communities). Worth noting that many of the holidays mentioned, likewise, are not public holidays in SG [2] - Jan 24th was, but Jan 22nd (listed as working) was a Sunday, inconsistent with a "working on regular working days" pattern most anywhere. Would be interesting to see a greater corpus of Jia Tan's writings, especially older ones. There are fairly distinctive idiosyncrasies that may be used to distinguish Singaporeans, Mainland Chinese and speakers of various Slavic languages (and Anglo natives). [1] https://boehs.org/node/everything-i-know-about-the-xz-backdoor [2] https://www.mom.gov.sg/employment-practices/public-holidays

https://boehs.org/node/everything-i-know-about-the-xz-backdoor This is the scariest part to me: > A pull request (https://github.com/jamespfennell/xz/pull/2) to a go library by a 1Password employee is opened asking to upgrade the library to the vulnerable version

I wish this were true too but it doesn't appear that llms.txt is meant to be a markdown version of the site's content based on the example on the site and after peeking at a few llms.txt files on some of the sites in the directory. It looks like its text meant to be fed into the llm as a system prompt specific to the site. The most simple ones just look like a sitemap restricted to documentation: https://www.activepieces.com/docs/llms.txt Some interesting stuff is in some of them. Like this one that prompts the LLM to explain to the user the ethical issues of using AI agents along with a disclaimer: https://boehs.org/llms.txt That site appears to be someone's blog and they don't seem like big fans of LLMs. https://boehs.org/node/llms-destroying-internet A pretty clever use of llms.txt.

Sites like ahrefs.com, semrush.com and majestic.com can show what sites link to your site. Looks like your site boehs.org is pretty popular with thousands of backlinks. Your top linked pages are: https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/truth-social https://boehs.org/node/npm-everything

Jia Tan's very first commit two years ago made suspicious changes to liblzma. See the timeline here: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

There's a lot of metadata about when/how they used git and IRC, and some preliminary analysis on same. Another surname in one of the commits. An apparent LinkedIn account. (See heading "OSINT" in https://boehs.org/node/everything-i-know-about-the-xz-backdoor .) A lot of these tracks could be intentionally manipulated by a sophisticated actor to disguise their identity, but it's not "nothing".

Based on the Chinese-sounding name alone? They also used two other sock puppet accounts that sound Indian and Anglo: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

The commit history from bad actor set tomezone to +0800 Source: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

It's mentioned in one of the first references in this article: https://boehs.org/node/everything-i-know-about-the-xz-backdoor IRC activity

Most (but not all ) VPN providers keep logs and payment info that are subpoenable. You could use something like Mulvad with Lightning Network payments, but I am not sure that even that is fully anonymous. The Witopia VPN that he used for IRC [1] is US based: https://www.personalvpn.com/contact-us/ and they don't mention neither LN payments nor not keeping logs. 1. "[email protected]" https://boehs.org/node/everything-i-know-about-the-xz-backdoor

Looking at how Jia75T got access to projects, it was vacuous sock puppets creating fake pressure. https://boehs.org/node/everything-i-know-about-the-xz-backdoor It feels like we should have better socialized defense against this kind of thing. When I see a name pop up online, I want an immediate readout on how active this person is over time and where. We need better tools to get high level views of who we are dealing with.

They probably have/will, though we are unlikely to find out what they get unless they manage to arrest/charge/try him. Jia Tan probably used a vpn though - we know that they did for accessing IRC (source: https://boehs.org/node/everything-i-know-about-the-xz-backdoor)

I'm assuming nation states and similar actors monitor mailing lists for phrases like "I'm feeling burnt out" or "not enough bandwidth, can you open a PR?" According to the timeline here, trust was established in "only" a few years. https://boehs.org/node/everything-i-know-about-the-xz-backdoor So I imagine major actors already have other assets in at-risk open source projects, either for the source code or distro patch/packaging level. Is that too tinfoil hat? I only know enough about secops to be dangerous to myself and everyone around me.

> Typical garbage argument based on the notion that open source developers are only doing it for the chance of employment. There is nothing in the article that supports you making this statement. It's not clear to be that you understood the arguments the author was making. The core of the argument is this: > But, in light of the recent xz Utils / SSH backdoor scandal, it is clear that while the bargain may not be entirely one-sided, it is not symmetrical, and significant bad consequences may result, both for the maintainers themselves and for society. Specifically the potential impact to society via scenarios similar to the above. The link from the article covers it well: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

Exactly I don't understand the obsession with Russia Literally just a country with people like you and me. "Jia Tan" does not sound Russian https://boehs.org/node/everything-i-know-about-the-xz-backdoor

It looks like he made multiple sock puppet accounts talking to himself on the mailing lists: https://boehs.org/node/everything-i-know-about-the-xz-backdoor He made a sock puppet asking debian to update the package in 'unstable'. (along with other package update requests so it wouldn't look suspicious).

There's good discussion of the timeline here: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

This has been investigated and the conclusion is IMO clear: the dogpilling accounts were part of the operation. See the parts about Jigar Kumar in this link: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

No, it's incredibly irresponsible to hand over the repo to someone else to manage, even someone who is an active contributor. See https://boehs.org/node/everything-i-know-about-the-xz-backdoor for example.

That's the same Hans Jansen mentioned here: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

> It's naive to believe that any form of physical presence means someone isn't going to do something nefarious in the eyes of the project. It's not the only thing, but it is something. There's a lot of social engineering that went into the xz backdoor[0]. This started years ago; Jia Tan was posting in projects and suddenly someone appeared to pressure projects to accept their code. Who's Jia Tan? Who's Jigar Kumar, the person who is pressuring others to accept patches from Jia Tan? We don't know. Probably some person or group sponsored by a state APT, but we don't know for sure, because they're currently just text on a screen. Having this person or group of people have to continually commit to the bit of publicly-known open-source maintainer who attends conferences, has an actual face, and is on security camera footage at multiple hotels and airports is far, far harder than just talking a vulnerable person into allowing maintainer access on a repository. Making them show up to different places a few times adds a layer of identity. Otherwise these "skilled eyes" could be anyone with a wide variety of motivations. [0]https://boehs.org/node/everything-i-know-about-the-xz-backdoor

One of the primary responsibilities of a maintainer is to ensure the security of the software. If they can't keep up with the pace of development in order to ensure this for their users, then this should be made clear to the community, and a decision should be made about how to proceed. Open source maintenance is an often stressful and thankless role, but this is part of the problem that allowed this to happen. Sure, a sophisticated attacker would be able to fool the eyes of a single tired maintainer, but the chances of that happening are much smaller if there's a stringent high bar of minimum quality, and at least one maintainer understands the code that is being merged in. Change proposals should never be blindly approved, regardless of who they come from. At the end of the day we have to be able to answer why this happened, and how we can prevent it from happening again. It's not about pointing fingers, but about improving the process. BTW, there have been several attempts at introducing backdoors in the Linux kernel. Some manage to go through, and perhaps we don't know about others, but many were thwarted due to the extreme vigilance of maintainers. Thankfully so, as everyone is well aware of how critical the project is. I'm not saying that all projects have the resources and visibility of Linux, but clearly vigilance is a requirement for lowering the chances of this happening. > That's assuming a maintainer wasn't compromised, like in this case. What makes you say…