Andres Freund and the xz backdoor
nytimes.com
nytimes.com
Huh, my take was that the "guy in Nebraska" was Lasse Collin, the original xz maintainer. Am I alone in that?
But I think this holds up in the spirit of it, which is that core open source contributors / maintainers keep things afloat despite a shocking lack of resources or investment by the companies that benefit from it. (Notwithstanding the fact that Freund is employed by Microsoft.)
These kind of analogies are always a bit of an eye roll for me but I’ll grant a few points for creativity here
No, it's Lasse Collin the _maintainer_ of xz..
> some researchers believe only a nation with formidable hacking chops, such as Russia or China, could have attempted it.
… or the US, UK, Israel, Germany, France, Canada, Australia, DPRK, Japan, etc, and the security offence companies that work as a supply chain for such nations in provision of embedded exploits.
It’s based on very weak logic, but perhaps “Jia Tan” rules out China.
The Stasi sometimes used real names for cover names as well so you could draw no conclusions at all from a fake identity, not even by process of elimination. At the end of the day I don't think you can infer anything from the names or geolocations involved.
Israel has shown in the past, with Stuxnet, that they have the skill, the patience, and the will. Same for Russia with Solarwinds.
If Jia Tan was using a FIDO/U2F key, it would be nice if someone would publish its public component so others can check for any traces of its use, but I honestly don't know how those work and whether such is even possible.
[Edited to add Russia to my personal list of countries I suspect. Something about the "misoeater91" name kinda suggests Russia to me somehow...]
</conspiracy_theory>
It's strange to see this included randomly in the middle of the article.
Ahh, the voices...