Hacker News Reader

Comment by FandangoRanger | Hacker News Reader

Reflections on trusting trust?

OK my getting downvoted shouldn't be a surprise. But it sure seems suspicious that the author introducing the bug made commits that end with this bug - and then silence. https://gcc.gnu.org/git/?p=gcc.git;a=search;h=d01b568a78351b...

His name and hotmail email is associated in git with various cryptography projects including openssl.

That’s a very interesting discovery.

And it's wrong, as the comment pointed out. Bernd Edlinger has been active since 2013, his most recent work was on GCC 10's static analyzer, which led to the discovery of an exploitable OpenSSL bug, and was seen in the press in April 2020 [0]. The initial bug report was posted on March, this can hardly be qualified as "going silent".

[0] https://www.theregister.com/2020/04/23/gcc_openssl_vulnerabi...

Thanks for clarifying.

Wow, nice find.

>But it sure seems suspicious that the author introducing the bug made commits for a few months that end with this bug

Your links shows commits 2016-2018

Activity through to 2020 http://patchwork.ozlabs.org/project/gcc/list/?submitter=2838...

Actually 2013-2018 if you click the "next" link hidden in the lower left corner.

thought I'd heard that name before, he's quite active, no idea how you ended up with "silence"

https://www.theregister.com/2020/04/23/gcc_openssl_vulnerabi...

Pepe Silvia, this name keeps comin' up over and over and over again. Every day Pepe's mail's getting sent back to me. Pepe Silvia, Pepe Silvia, I look in the mail, this whole box is Pepe Silvia! So I say to myself I gotta find this guy. I gotta go up to his office, I gotta put his mail in the guy's goddamn hands! Otherwise he's never gonna get it, it's gonna keep coming back down here. So I go up to Pepe's office and what do I find out, Mac, what do I find out? There is no Pepe Silvia. The man does not exist, okay? So I decided, ohh shit, buddy, I gotta dig a little deeper.

> OK my getting downvoted shouldn't be a surprise

FandangoRanger made a comment, said it can be a backdoor. And rurban made a comment, said it's unlikely to be a backdoor. Both have been downvoted. I guess the hivemind is fair enough...

A hivemind by definition does not conflict with itself. If both are being downvoted, that implies your hivemind does not exist, at least for this topic.

> If both are being downvoted, that implies your hivemind does not exist, at least for this topic.

Not necessarily so. Perhaps the hivemind is not interpreting the question as a binary one. For example, the downvote for "Reflections on trusting trust?" can be result from the cliche fatigue.

A hive mind with internal conflict or cognitive issues makes for great scifi in Ann Leckie's "Ancillary Justice".

The hivemind thinks that this qualifies as both conspiracy theory and nerd sniping and both sides of the argument should be abandoned.

Your search is broken, you are searching up to the specific commit.

Look now the history "ends" at a different commit: https://gcc.gnu.org/git/?p=gcc.git;a=search;h=5828c09abe00cc...

Reply on news.ycombinator.com