Hacker News Reader

Comment by buro9 | Hacker News Reader

who says that person exists? could well be a persona created for this purpose, with a team behind the persona

I want the team to talk more, maybe something will slip out.

Why would they, imo signs point to a nation state or at minimum a very sophisticated APT so it seems incredibly unlikely they're going to make a mistake like that.

If a nation-state then revealing themselves could cause a serious diplomatic incident. If not a nation-state then revealing themselves could expose them to criminal prosecution. The perpetrators almost certainly have been busy erasing their tracks and going underground. If they're not caught in spite of their best efforts, we'll never hear from them again.

where is there any law that says you can't put any code you want into open source that is completely visible, auditable , and reviewable by everyone who uses it?

not challenging you. Genuinely curious.

Does this not fall under the US CFAA Laws? I.e. intentionally adding malicious code?

The CFAA is quite broad. I wouldn't be surprised if it's broad enough to allow for prosecution in this case. If you interpret the CFAA as narrowly as possible then you might only be able to prosecute when the backdoor is exercised, but at the very least that you could. And then there's the world outside the U.S., where the laws might be broader.

Why would it matter that the thing being sabotaged is "completely visible, auditable , and reviewable"? Do you have any specific laws in mind that you think would not apply?

If you were referring to the malicious code being contributed, not to the open source project as a whole, I don't think "completely visible" is an accurate description of the deliberately obfuscated chain of m4 gobbledygook and binary blobs that makes up the backdoor.

Reply on news.ycombinator.com