"Semicolon is very much needed in C++ because what if you need to put two statements on the same line huh?"

*Rarely ever puts two statements on the same line because it's "bad form" or something.*

I remember some two decades ago... a professional C++ programmer contacted me in frustration, having pulled his hair out for literally hours. His code just wouldn't run. It was a missing semicolon which I spotted in one minute.

As bad as this #xz compromise is, it shows some things:

* #OpenSource "works". If this would have happened with a closed source app/lib, noone would have been able to spot this.

* Curiosity is nice. "Why is this taking longer" (by something of zero dot small seconds) and ending up with this....

* #Reproducible builds seem to allow to check that this didn't affect more - rebuild things with a known clean install and compare output with what the #distros had.

* Critical projects need a way to *reliably* get more maintainer power. And yes, that is easily said, not easily solved, I know. How likely do you think the xz maintainer is now with trust for others? How much would you trust others?
(Also, what is critical?)

* Proper funding might help. Companies that use and rely on open source (you know who you are. MANY you are!) ought to give something back. (And not just a token amount). Also, yes, another not-easy-to-solve problem comes up with this. But not-easy is no reason to not try.

As the xz thinkpieces start showing up about What Should Be Done, a couple of questions I'd encourage you to keep in mind while reading them:
- Is this advocating security nihilism and giving up because stopping 100% of badness is impossible?
- Is this pushing a random hobby horse like "sign your commits" that wouldn't have helped this incident in any way?
- Is this equating employment/nationality/notoriety with trustworthiness?
- Is this pushing a technical solution to a social problem?

The sad part about today's xz/liblzma discovery is that again critical infrastructure was maintained by overworked volunteers without sufficient assistance or support. We, as professional software engineers, or even we, as society, relying on their volunteer work, failed them.

https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html

snuggle defined raccoon

So, kids, what's the moral of the XZ story?

If you're going to backdoor something, make sure that your changes don't impact its performance. Nobody cares about security - but if your backdoor makes the thing half a second slower, some nerd is going to dig it up.

I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission.

The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().

It's RCE, not auth bypass, and gated/unreplayable.

More details in this thread: https://bsky.app/profile/did:plc:x2nsupeeo52oznrmplwapppl/post/3kowjkx2njy2b

by age 30 you should have spent years contributing to an open source project in your free time, building trust and becoming a maintainer, and then have skilfully inserted a highly obfuscated backdoor that successfully made its way into multiple linux distributions

The FTC has confirmed what we suspected: During the pandemic supply chain disruptions, big grocery chains pressured food suppliers to favor them over smaller competitors and hiked food prices to rake in record profits.

Those prices have stayed high even as disruptions eased.

Anyway the entire ops/dev world just dodged (we think/hope we dodged, anyway but are not 100% sure) the biggest supply chain attack in history that would have screwed absolutely, literally, everyone.

This needs a giant f**king industry-wide post-mortem once we're sure we're not all doomed.

The unsung heroes of today are all the backdoor authors who do proper benchmarking and profiling, so that they don't get caught because SSH logins are too slow.

subscribing to oss-security@ be like "Excessive time spent checking invalid RSA public keys", "Reflected XSS except it does not execute due to CSP", and then you become seeing "backdoor in upstream xz/liblzma leading to ssh server compromise" notification

(if this is how you learned, https://openwall.com/lists/oss-security/2024/03/29/4)

Look, I went over the Snowden documents as a journalist, but I never saw anything that shocked me quite like this story of Meta buying a VPN company for "security" but then spying on users of competitive apps by decrypting the traffic.

This is a real SSL added and removed here :) moment.

Seriously, like wow: https://techcrunch.com/2024/03/26/facebook-secret-project-snooped-snapchat-user-traffic/

Court document: https://storage.courtlistener.com/recap/gov.uscourts.cand.369872/gov.uscourts.cand.369872.735.0.pdf

German #folklore is _full_ of tales of evil, prideful nobles who were eventually punished for their sins.

So why is modern media - starting with #Disney , and moving on from there - so full of pro- #monarchy propaganda instead? Lots of "Just Kings", "Plucky Princesses", and so forth. Why is the implication in media nowadays that being exalted by the circumstances of your birth is likely to make you a good person? Instead of being totally oblivious to your own class privilege - and that's probably the _best_ case!

I wonder if anyone has done any scientific research on all these "pro-monarchy" narratives in modern media, and how they came into existence.

It's important to understand that "age verification" schemes being passed by states, ostensibly to "protect the children", won't do that and will bring about incredible abuses.

In order to age verify children, obviously EVERYBODY of any age must be verified, for every account, under every name or pseudonym, ultimately on every site no matter how public or private the topic, and before downloading any apps.

Children will find ways to work around this. They'll use the accounts of adults, which will be openly traded. But because these age verification systems must by definition be based on government IDs, the verification process creates a linkage between your account names and your actual identity, subjecting you to all manner of leaked personal information, government abuses (think MAGA in charge), and worse. Firms will claim their systems either don't keep this data or can't be abused. History strongly suggests otherwise, and when courts step in, those firms will have to do what the courts say, often in secret, when it comes to collecting data.

Age verification is in actuality a massive Chinese-style Internet identity tracking project -- nothing less -- and there are many politicians in the U.S. who look with envy at how China controls their Internet and keeps their Internet users under police state controls.

general reminder that anyone who thinks the world is overpopulated or will be in the near future is a fascist.

the world produces enough food to feed 10 billion people already. there's space to house that many, if only we had the political will to make housing a public service and destroy the concept of private property (as in landlordism; your toothbrush and undies will still be your toothbrush and undies).

white people make up about 15% of the world population. 'overpopulation' should be read to mean 'too many people who aren't white', and can thus be discarded. discard relationships with the people making such arguments while you're at it.

Like, seriously, do you folks not understand what you're saying?

Birth rates in western capitalist countries, you know, the ones PRIMARILY responsible for boiling the planet, are declining. So what you're doing, is showing up in my mentions to low-key advocate for mercing brown people. Like that's literally what you're doing; that's where your line of argument ends.

If you were just WRONG, and you fucking are, I might ignore that. But my replies are not a safe space for nazi propaganda.

Boost if you (Nyan-binary edition):
🐈

- Are nonbinary
- Have at least one nonbinary friend
- Either hoard too much gender or not enough
- Are secretly several animals in a trenchcoat
- Probably met a nonbinary person once

💛🤍💜🖤

Nobody will ever know which apply to you! xD

#nonbinary #boost #silly