6 ms·

A SourceGraph search like this shows https://sourcegraph.com/search?q=context:global+JiaT75&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:gl

by bed99 2y ago

A SourceGraph search like this shows https://sourcegraph.com/search?q=context:global+JiaT75&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+JiaT75&patte... - Jia Tan <jiat75@gmail.com> - jiat75 <jiat0218@gmail.com> ``` amap = generate_author_map("xz") test_author = amap.get_author_by_name("Jia Cheong Tan") self.assertEqual( test_author.names, {"Jia Cheong Tan", "Jia Tan", "jiat75"} ) self.assertEqual( test_author.mail_addresses, {"jiat0218@gmail.com", "jiat75@gmail.com"} ) ```

pryce 2y ago
additionally, even though the commit messages they've made are mostly plain, there may be features of their commit messages that could provide leads, such as his using what looks like a very obscure racist joke of referring to a gitignore file as a 'gitnigore'. There's barely a handful of people on the whole planet making this 'joke'.
- berdario 2y ago
  Can you point to where you saw that racist joke? I don't see anything at https://sourcegraph.com/search?q=context:global+author:jiat0218%40gmail.com+gitnigore&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+author:jiat0...
  - pryce 2y ago
    first commit made in one of JiaT75's other repos https://github.com/JiaT75/STest/commits/master/ https://github.com/JiaT75/STest/commits/master/
    - berdario 2y ago
      Thank you. If you wouldn't have explained the background, I totally would've thought that this is just an innocent typo. (I still think it's like... 60% a typo? don't know) Anyhow, other people called the CCing of JiaT75 by Lasse suspicious: https://news.ycombinator.com/item?id=39867593 https://news.ycombinator.com/item?id=39867593 https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.collin@tukaani.org/ https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co... Someone pointed out the "mental health issues" and "some other things" https://news.ycombinator.com/item?id=39868881 https://news.ycombinator.com/item?id=39868881 https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... Lasse is of course a Nordic name, and the whole project has a finnish name and hosting https://news.ycombinator.com/item?id=39866902 https://news.ycombinator.com/item?id=39866902 If I wanted to go rogue and insert a backdoor in a project of mine, I'd probably create a new sockpuppet account and hand over management of the project to them. The above is worringly compatible with this hypothesis. OTOH, JiaT75 did not reuse the existing hosting provider, but rather switched the site to github.io and uploaded there old tarballs: https://github.com/tukaani-project/tukaani-project.github.io/commit/071a8acf097e11b659f6d7eb0f3b2e5e8934de0e https://github.com/tukaani-project/tukaani-project.github.io... If JiaT75 is an old-timer in the project, wouldn't they have kept using the same hosting infra? There are also some other grim possibilities: someone forced Lasse to hand over the project (violence or blackmailing? as farfetched as that sounds)... or maybe stole Lasse devices (and identity?) and now Lasse is incapacitated? Or maybe it's just some other fellow scandinavian who pretended to be chinese and got Lasse's trust. In which case I wish Lasse all the best, and hope they'll be able to clear their name. Is the same person sockpuppeting Hans Jansen? It's amusing (but unsurprising) that they are using both german-sounding and chinese-sounding identities. That said, I don't think it's unreasonable to think that Lasse genuinely trusted JiaT75, genuinely believed that the ifunc stuff was reasonable (it probably isn't: https://news.ycombinator.com/item?id=39869538 https://news.ycombinator.com/item?id=39869538 ) and handed over the project to them. And at the end of the day, the only thing linking JiaT75 to a nordic identity is a nordic racist joke which could well be a typo. People already checked the timezone of the commits, but I wonder if anyone has already checked the time-of-day of those commits... does it actually match the working hours that a person genuinely living (and sleeping) in China would follow? (of course, that's also easy to manipulate, but maybe they could've slip up) Anyhow, I guess that security folks at Microsoft and Google (because of JiaT75 email account) are probably going to cooperate with authorities on trying to pin down the identity of JiaT75 (which might not be very useful, depending on where they live).
      - berdario 2y ago
        > does it actually match the working hours that a person genuinely living (and sleeping) in China would follow? No, it doesn't: https://play.clickhouse.com/play?user=play#U0VMRUNUIHRvSG91cihjcmVhdGVkX2F0KSBBUyBob3VyLCBjb3VudCgqKSBGUk9NIGdpdGh1Yl9ldmVudHMgV0hFUkUgYWN0b3JfbG9naW49J0ppYVQ3NScgR1JPVVAgQlkgaG91ciBPUkRFUiBCWSBob3Vy https://play.clickhouse.com/play?user=play#U0VMRUNUIHRvSG91c... The vast majority of their Github interactions are between 12.00 UTC and 18.00 UTC
      - junon 2y ago
        It's worth mentioning Lasse is still online in the Libera chat room, idling. Nothing's been said.
        berdario 2y ago
        From elsewhere in the comments: https://news.ycombinator.com/item?id=39874621 https://news.ycombinator.com/item?id=39874621 > He came on IRC, he seemed ok. He did some cleanup of access and signed off for easter.
- Bulat_Ziganshin 2y ago
  i think it's American trauma. outside of the Western hemisphere, sexist and racist jokes are just jokes
- AnarchismIsCool 2y ago
  Pretty sure this is just a typo...
berdario 2y ago
I tried to understand the significance of this (parent maybe implied that they reused a completely fictitious identity generated by some test code), and I think this is benign. That project just includes some metadata about a bunch of sample projects, and it links directly to a mirror of the xz project itself: https://github.com/se-sic/VaRA-Tool-Suite/blob/982bf9b9cbf646be09987f18b483345804d91b34/varats/varats/projects/c_projects/xz.py#L60 https://github.com/se-sic/VaRA-Tool-Suite/blob/982bf9b9cbf64... I assume it downloads the project, examines the git history, and the test then ensures that the correct author name and email addresses are recognized. (that said, I haven't checked the rest of the project, so I don't know if the code from xz is then subsequently built, and or if this other project could use that in an unsafe manner)
deleted 2y ago
[deleted]
KomoD 2y ago
Interesting thing about this jiat75@gmail.com email is that it seems to not exist? The google account: "Couldn't find your Google Account" The email: "50 5.1.1 The email account that you tried to reach does not exist" But then when you try to register it says it's taken. Was it disabled?
- bed99 2y ago
  I'd say at this point all major tech companies, ISPs and authorities should have more enough information and disabling and freezing their accounts would be the first step.
- Flame 2y ago
  This can happen if you delete your old gmail account. Source: I deleted a gmail account I shouldn't have years ago. It will say taken if it previously existed, and was deleted.

by bed99 2y ago

pryce 2y ago

additionally, even though the commit messages they've made are mostly plain, there may be features of their commit messages that could provide leads, such as his using what looks like a very obscure racist joke of referring to a gitignore file as a 'gitnigore'. There's barely a handful of people on the whole planet making this 'joke'.

berdario 2y ago
Can you point to where you saw that racist joke? I don't see anything at https://sourcegraph.com/search?q=context:global+author:jiat0218%40gmail.com+gitnigore&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+author:jiat0...
- pryce 2y ago
  first commit made in one of JiaT75's other repos https://github.com/JiaT75/STest/commits/master/ https://github.com/JiaT75/STest/commits/master/
  - berdario 2y ago
    Thank you. If you wouldn't have explained the background, I totally would've thought that this is just an innocent typo. (I still think it's like... 60% a typo? don't know) Anyhow, other people called the CCing of JiaT75 by Lasse suspicious: https://news.ycombinator.com/item?id=39867593 https://news.ycombinator.com/item?id=39867593 https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.collin@tukaani.org/ https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co... Someone pointed out the "mental health issues" and "some other things" https://news.ycombinator.com/item?id=39868881 https://news.ycombinator.com/item?id=39868881 https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... Lasse is of course a Nordic name, and the whole project has a finnish name and hosting https://news.ycombinator.com/item?id=39866902 https://news.ycombinator.com/item?id=39866902 If I wanted to go rogue and insert a backdoor in a project of mine, I'd probably create a new sockpuppet account and hand over management of the project to them. The above is worringly compatible with this hypothesis. OTOH, JiaT75 did not reuse the existing hosting provider, but rather switched the site to github.io and uploaded there old tarballs: https://github.com/tukaani-project/tukaani-project.github.io/commit/071a8acf097e11b659f6d7eb0f3b2e5e8934de0e https://github.com/tukaani-project/tukaani-project.github.io... If JiaT75 is an old-timer in the project, wouldn't they have kept using the same hosting infra? There are also some other grim possibilities: someone forced Lasse to hand over the project (violence or blackmailing? as farfetched as that sounds)... or maybe stole Lasse devices (and identity?) and now Lasse is incapacitated? Or maybe it's just some other fellow scandinavian who pretended to be chinese and got Lasse's trust. In which case I wish Lasse all the best, and hope they'll be able to clear their name. Is the same person sockpuppeting Hans Jansen? It's amusing (but unsurprising) that they are using both german-sounding and chinese-sounding identities. That said, I don't think it's unreasonable to think that Lasse genuinely trusted JiaT75, genuinely believed that the ifunc stuff was reasonable (it probably isn't: https://news.ycombinator.com/item?id=39869538 https://news.ycombinator.com/item?id=39869538 ) and handed over the project to them. And at the end of the day, the only thing linking JiaT75 to a nordic identity is a nordic racist joke which could well be a typo. People already checked the timezone of the commits, but I wonder if anyone has already checked the time-of-day of those commits... does it actually match the working hours that a person genuinely living (and sleeping) in China would follow? (of course, that's also easy to manipulate, but maybe they could've slip up) Anyhow, I guess that security folks at Microsoft and Google (because of JiaT75 email account) are probably going to cooperate with authorities on trying to pin down the identity of JiaT75 (which might not be very useful, depending on where they live).
    - berdario 2y ago
      > does it actually match the working hours that a person genuinely living (and sleeping) in China would follow? No, it doesn't: https://play.clickhouse.com/play?user=play#U0VMRUNUIHRvSG91cihjcmVhdGVkX2F0KSBBUyBob3VyLCBjb3VudCgqKSBGUk9NIGdpdGh1Yl9ldmVudHMgV0hFUkUgYWN0b3JfbG9naW49J0ppYVQ3NScgR1JPVVAgQlkgaG91ciBPUkRFUiBCWSBob3Vy https://play.clickhouse.com/play?user=play#U0VMRUNUIHRvSG91c... The vast majority of their Github interactions are between 12.00 UTC and 18.00 UTC
    - junon 2y ago
      It's worth mentioning Lasse is still online in the Libera chat room, idling. Nothing's been said.
      - berdario 2y ago
        From elsewhere in the comments: https://news.ycombinator.com/item?id=39874621 https://news.ycombinator.com/item?id=39874621 > He came on IRC, he seemed ok. He did some cleanup of access and signed off for easter.
Bulat_Ziganshin 2y ago
i think it's American trauma. outside of the Western hemisphere, sexist and racist jokes are just jokes
AnarchismIsCool 2y ago
Pretty sure this is just a typo...

berdario 2y ago

I tried to understand the significance of this (parent maybe implied that they reused a completely fictitious identity generated by some test code), and I think this is benign. That project just includes some metadata about a bunch of sample projects, and it links directly to a mirror of the xz project itself: https://github.com/se-sic/VaRA-Tool-Suite/blob/982bf9b9cbf646be09987f18b483345804d91b34/varats/varats/projects/c_projects/xz.py#L60 https://github.com/se-sic/VaRA-Tool-Suite/blob/982bf9b9cbf64... I assume it downloads the project, examines the git history, and the test then ensures that the correct author name and email addresses are recognized. (that said, I haven't checked the rest of the project, so I don't know if the code from xz is then subsequently built, and or if this other project could use that in an unsafe manner)

deleted 2y ago

[deleted]

KomoD 2y ago

Interesting thing about this jiat75@gmail.com email is that it seems to not exist? The google account: "Couldn't find your Google Account" The email: "50 5.1.1 The email account that you tried to reach does not exist" But then when you try to register it says it's taken. Was it disabled?

bed99 2y ago
I'd say at this point all major tech companies, ISPs and authorities should have more enough information and disabling and freezing their accounts would be the first step.
Flame 2y ago
This can happen if you delete your old gmail account. Source: I deleted a gmail account I shouldn't have years ago. It will say taken if it previously existed, and was deleted.