Hacker News Reader

Comment by maerF0x0 | Hacker News Reader

Two points I'd be interested in discussing.

1. It seems a lot of people are assuming Jia Tian was compromised all along. I haven't seen a reason to believe this was a long play, but rather that they were compromised along the way (and selected for their access). Why play the long game of let's find a lone package, w/ a tired maintainer, and then try to get in good with them vs. Let's survey all packages w/ a tired maintainer, and compromise a new entrant (ie bribe/beat them).

2. IMO this also is a failing on behalf of many government agencies. NSA, NIST, FBI all should, IMO spend less time compromising their own citizenry, and more time focusing on shoring up the security risks Americans face.

View on HN

Completely conclusive proof? No, but it seems unlikely that there ever would be conclusive proof of such.

They don't seem to exist outside of this incident and things related to this.

There were multiple people who also don't seem to exist outside of their posts to the xz mailing list applying pressure for the original maintainer to bring Jia on board. This occurred around the time that Jia was first making contact with the project, not only recently.

Apparently the IP addresses that were logged for Jia is a VPN based in Singapore

They have vanished.

Honestly, there's very little evidence that they weren't always intending this.

What's your source for the IP addresses?

It's mentioned in one of the first references in this article:

https://boehs.org/node/everything-i-know-about-the-xz-backdo...

IRC activity

I can't remember where I read that but it would likely have been from a HN link or possibly a comment.

I just found this: https://news.ycombinator.com/item?id=39868773 which is definitely not where I originally read it, but libera is probably ultimately the source

> It seems a lot of people are assuming Jia Tian was compromised all along. I haven't seen a reason to believe this was a long play, but rather that they were compromised along the way

So I assume Jia has spoken out since? How do you go this long without realising someone else is making plays as you?

I took a look at Jia Tan's early behavior, and I found it to be consistent with being "compromised" from the beginning. They had months of contributions on private repos before forking a test library and making superficial changes to it, and then diving headlong into archival libraries. It all looks set up and I see no evidence of an actual person at any point.

I also think it is more difficult to get away with bribing/beating an existing contributing than you suggest; esp since failure means likely exposure.

Regarding point 1: The timeline in the linked article describes some communications as "pressure emails." I've heard the theory, but haven't seen solid evidence, that the pressure emails weren't just regular impatience from outside devs, but actually part of the attack. To convince the primary maintainer into granting access to another party.

Occams Razor and a variation on Hanlon's razor to me suggest that Jia actually wanted to solve the issues and work on code. They contributed some things to other repos too, correct? (I saw another thread about microsoft documentation, for eg).

Here's the thing, if the maintainer was so tired and needed the help, the pressure is more risk than reward. The maintainer would be relieved to have help... But pressure risks estranging...

To be clear I'm aware this is just my own musing though.

Reply on news.ycombinator.com