Hacker News Reader

Comment by Solvency | Hacker News Reader

Why can't they interview the guy who made it? Some say he's still posting on that board.

who says that person exists? could well be a persona created for this purpose, with a team behind the persona

I want the team to talk more, maybe something will slip out.

Why would they, imo signs point to a nation state or at minimum a very sophisticated APT so it seems incredibly unlikely they're going to make a mistake like that.

If a nation-state then revealing themselves could cause a serious diplomatic incident. If not a nation-state then revealing themselves could expose them to criminal prosecution. The perpetrators almost certainly have been busy erasing their tracks and going underground. If they're not caught in spite of their best efforts, we'll never hear from them again.

where is there any law that says you can't put any code you want into open source that is completely visible, auditable , and reviewable by everyone who uses it?

not challenging you. Genuinely curious.

Does this not fall under the US CFAA Laws? I.e. intentionally adding malicious code?

The CFAA is quite broad. I wouldn't be surprised if it's broad enough to allow for prosecution in this case. If you interpret the CFAA as narrowly as possible then you might only be able to prosecute when the backdoor is exercised, but at the very least that you could. And then there's the world outside the U.S., where the laws might be broader.

Why would it matter that the thing being sabotaged is "completely visible, auditable , and reviewable"? Do you have any specific laws in mind that you think would not apply?

If you were referring to the malicious code being contributed, not to the open source project as a whole, I don't think "completely visible" is an accurate description of the deliberately obfuscated chain of m4 gobbledygook and binary blobs that makes up the backdoor.

That board? What board?

We should lure him/her with a bait, like the winrar source code or something… give him hope for redemption.

Reply on news.ycombinator.com