Hacker News Reader

Comment by rovyko | Hacker News Reader

>... that individual employees could be targeted by law enforcement to make secret changes to systems

So with the TOLA act, who is under the Australian government's jurisdiction and can be compelled to do this? Only those residing in Australia? Any citizen anywhere in the world? Anyone with assets or interests that could be leveraged?

What does this mean for Australians seeking employment in other countries?

https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...

View on HN

it means if the PR was submitted by an Aussie (or resident) you better make sure your code review has a non-Aussie on it.

Do you think the presence of a code review practices alone will be enough of a deterrent against agencies using devs for this purpose?

Even if you pressure someone to make a backdoor and they get caught, you've just exposed your intentions when it could have been easier to go straight to the company.

I don’t think A PR is the only attack vector. I would be suspect of the entire CI/CD pipeline and any production systems or distribution systems in employed

Also, if I were an Aussie and I'd gotten a request like this, I'd feel pretty incentivized to make the backdoor as blatant and suspicious-looking as possible. The government ordered you to do it; it did not order you to do a good job.

So "evil PR" would probably be the easiest thing to catch, and it definitely seems like other compromise vectors are where the real danger is.

    public function rot13_GbgnyylAbgNOnpxqbbe()

Something subtle like that?

Fwiw the UK has near identical legislation and I'm pretty sure the Aussie gov looked at ours first.

We lead the world in subtly corrupting democracy.

What if you accidentally cast your coding session to your Twitch stream?

Reply on news.ycombinator.com