4 ms·

You do realize that "that shit" was part of the obfuscated and xz-compressed backdoor hidden as binary test file, right? It was never committed in plain sight.

by plg94 2y ago

You do realize that "that shit" was part of the obfuscated and xz-compressed backdoor hidden as binary test file, right? It was never committed in plain sight. You can go to https://git.tukaani.org/xz.git https://git.tukaani.org/xz.git and look at the commits yourself – while the commits of the attacker are not prime examples of "good commits", they don't have glaringly obvious red flags either. This backdoor was very sophisticated and well-hidden, so your comment misses the point completely.

johnisgood 2y ago
> It was never committed in plain sight. It was though. I have seen those two test files being added by a commit on GitHub. Unfortunately it has been disabled by now, so I cannot give you a working link.
- fullstop 2y ago
  It really wasn't, though. commit 74b138d2a6529f2c07729d7c77b1725a8e8b16f1 Author: Jia Tan <jiat0218@gmail.com> Date: Sat Mar 9 10:18:29 2024 +0800 Tests: Update two test files. The original files were generated with random local to my machine. To better reproduce these files in the future, a constant seed was used to recreate these files. diff --git a/tests/files/bad-3-corrupt_lzma2.xz b/tests/files/bad-3-corrupt_lzma2.xz index 926f95b0..f9ec69a2 100644 Binary files a/tests/files/bad-3-corrupt_lzma2.xz and b/tests/files/bad-3-corrupt_lzma2.xz differ diff --git a/tests/files/good-large_compressed.lzma b/tests/files/good-large_compressed.lzma index 8450fea8..878991f3 100644 Binary files a/tests/files/good-large_compressed.lzma and b/tests/files/good-large_compressed.lzma differ Would you bat an eye at this? If it were from a trusted developer and the code was part of a test case? If you looked at strings contained within the bad file, you might notice that this was not random: 7zXZ ####Hello#### 7zXZ w,( 7zXZ ####World#### But, again, this was a test case.
  - zzzeek 2y ago
    > Would you bat an eye at this? If it were from a trusted developer and the code was part of a test case? well lets all agree that now, if we see commits affecting / adding binary data with "this was generated locally with XYZ", that now we will bat an eye at it.
    - fullstop 2y ago
      Without a doubt!
  - johnisgood 2y ago
    Yeah, again, "committed in plain sight" it was, was it not? Batting an eye on it or not is another matter.
    - fullstop 2y ago
      If it's obfuscated or deceptive, as it was, it's really not plain sight.
      - johnisgood 2y ago
        Some of his commits were NOT obfuscated, committed in plain sight, yet no one has batted an eye, for reasons. So whatever floats your boat by adding that sentence, regardless, and however you may define "plain sight". It is a binary file to begin with.
        fullstop 2y ago
        Can you point one out?

by plg94 2y ago

johnisgood 2y ago

> It was never committed in plain sight. It was though. I have seen those two test files being added by a commit on GitHub. Unfortunately it has been disabled by now, so I cannot give you a working link.

fullstop 2y ago
It really wasn't, though. commit 74b138d2a6529f2c07729d7c77b1725a8e8b16f1 Author: Jia Tan <jiat0218@gmail.com> Date: Sat Mar 9 10:18:29 2024 +0800 Tests: Update two test files. The original files were generated with random local to my machine. To better reproduce these files in the future, a constant seed was used to recreate these files. diff --git a/tests/files/bad-3-corrupt_lzma2.xz b/tests/files/bad-3-corrupt_lzma2.xz index 926f95b0..f9ec69a2 100644 Binary files a/tests/files/bad-3-corrupt_lzma2.xz and b/tests/files/bad-3-corrupt_lzma2.xz differ diff --git a/tests/files/good-large_compressed.lzma b/tests/files/good-large_compressed.lzma index 8450fea8..878991f3 100644 Binary files a/tests/files/good-large_compressed.lzma and b/tests/files/good-large_compressed.lzma differ Would you bat an eye at this? If it were from a trusted developer and the code was part of a test case? If you looked at strings contained within the bad file, you might notice that this was not random: 7zXZ ####Hello#### 7zXZ w,( 7zXZ ####World#### But, again, this was a test case.
- zzzeek 2y ago
  > Would you bat an eye at this? If it were from a trusted developer and the code was part of a test case? well lets all agree that now, if we see commits affecting / adding binary data with "this was generated locally with XYZ", that now we will bat an eye at it.
  - fullstop 2y ago
    Without a doubt!
- johnisgood 2y ago
  Yeah, again, "committed in plain sight" it was, was it not? Batting an eye on it or not is another matter.
  - fullstop 2y ago
    If it's obfuscated or deceptive, as it was, it's really not plain sight.
    - johnisgood 2y ago
      Some of his commits were NOT obfuscated, committed in plain sight, yet no one has batted an eye, for reasons. So whatever floats your boat by adding that sentence, regardless, and however you may define "plain sight". It is a binary file to begin with.
      - fullstop 2y ago
        Can you point one out?