Hacker News Reader

Comment by Bromeo | Hacker News Reader

I don't want to read too much into it, but the person (supposedly) submitting the PR seems to work at 1Password since December last year, as per his Linkedin. (And his Linkedin page has a link to the Github profile that made the PR).

View on HN

They're definitely a real person. I know cause that "1Password employee since December" is a person I know IRL and worked with for years at their prior employer. They're not a no-name person or a fake identity just FYI. Please don't be witch hunting; this genuinely looks like an unfortunate case where Jared was merely proactively doing their job by trying to get an externally maintained golang bindings of XZ to the latest version of XZ. Jared's pretty fantastic to work with and is definitely the type of person to be filing PRs on external tools to get them to update dependencies. I think the timing is comically bad, but I can vouch for Jared.

https://github.com/jamespfennell/xz/pull/2

If I were trying to compromise supply chains, getting into someplace like 1Password would be high up on the list.

Poor guy, he's probably going to get the third degree now.

As a 1Password user, I just got rather nervous.

Yubikeys starting to look kinda yummy.

Hardware gets backdoored too, remember Crypto AG?

Yeah the GitHub account looks really really legitimate. Maybe it was compromised though?

What looks legit about a gmail address and some stock art for a profile?

[Deleted per below]

Can you stay in that org after leaving Google?

whoever is in charge of removing people from the Google github org has the itchiest trigger finger in the whole exiting-the-company process tree.

You are not looking at the right profile. This is the profile that people are talking about: https://github.com/jaredallard

Oops, you're absolutely correct. Deleted (via edit) my comment above. Thanks.

He was just (50 minutes ago) removed from the oss fuzz repo.

I hope this also (at least temporarily until verification of 'bad/good') remove him from the org?

Plus the README.md that is just a rickroll

The 2 GMail accounts are 85% / mainly associated with XZ work, since 2021, per searching for them explicitly via Google.

The PR's two commits are signed by a key that was also used to sign previous commits belonging to that author.

Hold up, are you saying that https://github.com/jaredallard and the accounts affiliated with this XZ backdoor share a PGP key? Or something else?

No, this account made a PR and their commits were signed [1]. Take a look at their other repositories, e.g. they did AoC 2023 in Rust and published it, the commits in that repository are signed by the same key. So this is not (just) a GitHub account compromise.

I find this aspect to be an outlier, the other attacker accounts were cutouts. So this doesn't quite make sense to me.

[1] https://github.com/jamespfennell/xz/pull/2/commits

Reply on news.ycombinator.com