6 ms·

Excellent summary of the events, with all the links in one place. This is the perfect resource for anyone who want to catch up, and also to learn about how such

by gawa 2y ago

Excellent summary of the events, with all the links in one place. This is the perfect resource for anyone who want to catch up, and also to learn about how such things (especially social engineering) unfold in the wild, out in the open. One thing that could be added, for the sake of completeness: in the part "Attack begins", toward the end, when they are pushing for updating xz in the major distros, Ubuntu and Debian are mentioned but not Fedora. Looks like the social engineering/pressuring for Fedora started at least weeks before 2024 March 04, according to a comment by @rwmj on HN [1]. I also found this thread on Fedora's devel list [2], but didn't dig too much. [1] https://news.ycombinator.com/item?id=39866275 https://news.ycombinator.com/item?id=39866275 [2] https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/ZAVLWJ7643VWZEWXGYBS2HYQMDDAD24O/#6CHEWRBCCRJCBZ7BIYYIAMMFQUDXVC6F https://lists.fedoraproject.org/archives/list/devel@lists.fe...

deleted 2y ago
[deleted]
sfjailbird 2y ago
It would be intetesting if Lasse Collin published his off-list interactions with 'Jia Tan' and any of the other pseudonyms, to get an even better angle on the social engineering parts. Apparently a large part of the campaign was via private channels to Lasse.
- larntz 2y ago
  I was wondering if that would be released also. I hope so but wouldn't blame them if they decide not to.
  - bigiain 2y ago
    I wouldn't blame then if they've thrown all their computers into the sea, changed their name, and taken upon a job building timber furniture...
    - jtriangle 2y ago
      I, too, have had days like that
    - jaystraw 2y ago
      as an alaskan, those aren't mutually exclusive
- publius_0xf3 2y ago
  Collin has been writing more extensively on IRC. A screenshot of one of his posts can be seen in [this YouTube video](https://youtu.be/0pT-dWpmwhA?t=1158 https://youtu.be/0pT-dWpmwhA?t=1158). He notes that while he was unsatisfied with some of the changes Tan introduced, Tan was nonetheless extremely helpful.
  - runeks 2y ago
    > [...] unsatisfied with some of the changes Tan introduced [...] That's one way to put it

by gawa 2y ago

deleted 2y ago

[deleted]

sfjailbird 2y ago

It would be intetesting if Lasse Collin published his off-list interactions with 'Jia Tan' and any of the other pseudonyms, to get an even better angle on the social engineering parts. Apparently a large part of the campaign was via private channels to Lasse.

larntz 2y ago
I was wondering if that would be released also. I hope so but wouldn't blame them if they decide not to.
- bigiain 2y ago
  I wouldn't blame then if they've thrown all their computers into the sea, changed their name, and taken upon a job building timber furniture...
  - jtriangle 2y ago
    I, too, have had days like that
  - jaystraw 2y ago
    as an alaskan, those aren't mutually exclusive
publius_0xf3 2y ago
Collin has been writing more extensively on IRC. A screenshot of one of his posts can be seen in [this YouTube video](https://youtu.be/0pT-dWpmwhA?t=1158 https://youtu.be/0pT-dWpmwhA?t=1158). He notes that while he was unsatisfied with some of the changes Tan introduced, Tan was nonetheless extremely helpful.
- runeks 2y ago
  > [...] unsatisfied with some of the changes Tan introduced [...] That's one way to put it