Hacker News Reader

Comment by noman-land | Hacker News Reader

I haven't been following this story super closely but I find it extremely odd that I've heard zero discussion about the perpetrator of this hack.

View on HN

> However, I believe that he is actually from somewhere in the UTC+02 (winter)/UTC+03 (DST) timezone, which includes Eastern Europe (EET), but also Israel (IST)

https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...

> but also Israel (IST)

I had the same thought myself initially, but the analysis suggests a work-week that includes Fri, which precludes Israel (where the work week is Sun-Thu and not Mon-Fri), as well as celebrating Christmas and New Year's which are not official holidays in Israel. It isn't uncommon for younger people to take a day off for New Year's since it is an excuse to party, or for Jews with eastern European origins to celebrate Novy God, but I don't know of any Christmas celebrations.

Obviously these could be faked, but then why fake a Mon-Fri work week and not also fake the work hours to match it? To me it seems like an unlikely hypothesis.

and I believe someone pointed out that there were commits on yom kippur? that is a day basically no one works. The skies are closed, the roads are empty and everyone is bicycling on all the available streets, including highways.

Israel isn't home only for Jewish people who don't work on Yom Kippur, there are significant populations of both Muslims and Chirstians

I don't think that you can rule out any country based on email and commit timestamps, the attacker could have been further east and had a late work day, or further east with an early work day

I hate to defend Israel’s work week here, because it sucks to an unimaginable extent, but while you’re free not to observe Jewish holidays in Israel, unless you’re lucky to live in one of a handful of places you’ll struggle heavily to get anything done on Fri or Sat. If you try, you’ll find nothing works during most of that time including public transport—except for Friday morning when you’re going to have to scramble to get stuff done so you don’t run out of food before Sunday morning. On Yom Kippur, even driving around in your own car is going to get you fined. And, of course, nearly nothing managed by the governments works on the weekend or holidays, except for the military.

(I wouldn’t put it past the intelligence services to keep working during official holidays as a form of obfuscation, mind you. I just wanted to point out that it isn’t as straightforward a deal as Christians—or atheists for that matter—existing: Israel sure makes daily life hard for them.)

I am an Israeli, and I agree with you. I just wanted to point out that trying to speculate a location for the attacker based on what days they worked isn't going to be remotely accurate

Speaking of innacurate things, since the actual XZ git.repository isn't hosted on GitHub, could there be logs of which IP address the attacker was operating from?

There's been lots of speculation. It seems likely to be more than one person, likely either a ransomware group or a national intelligence agency.

I would be interested in semantic analysis of the communication from the involved online personas, similar to what was done for Satoshi, to point to a cultural direction. Would also be interesting to see if there were semantic style differences over time pointing to different people acting as the personas.

Since it would be quite a lot of code that has been committed as well, would also be interesting to see if code style differences could be found pointing to more people involved than only one.

There is nothing of value to gain from such analysis. Even if evidence turns up, it would be even more flimsy than graphology.

Since when does does satisfying curiosity not provide any value. This has the potential to be a real life spy story ffs. Yeah you won't know anything for sure, that doesn't make this any less interesting.

I fully agree. Stylometry is surprinsingly accurate (as proven on this very forum corpus) and would be quite involved to hide from.

Has anyone studied yet how well this kind of analysis holds up to simply asking GPT to rephrase your words? The whole thing goes out the window if that kind of attack works nowadays.

What’s to discuss? Nothing is known about him.

There's a lot of metadata about when/how they used git and IRC, and some preliminary analysis on same. Another surname in one of the commits. An apparent LinkedIn account. (See heading "OSINT" in https://boehs.org/node/everything-i-know-about-the-xz-backdo... .)

A lot of these tracks could be intentionally manipulated by a sophisticated actor to disguise their identity, but it's not "nothing".

Like I said, we don't know anything worth having a real discussion about. Maybe he was in the +03 time zone, and pretending to be in +08, but that's not enough to base a discussion on.

You're discussing it.

We are all speculating.

So this whole thread is based on the premise that the OP was using the formal definition of "discuss" rather than the informal one? Which is almost certainly not true?

Ya'll must be super fun at parties.

Either kind of discussion is useless since the "evidence" (timezone IDs in strings that are not required to have any relation whatsoever with reality) is flimsy to begin with.

LOL. You continue to discuss it.

We are quite far in a meta-discussion. Even less useful.

And... you continue to discuss it.

I'm going to stop now. You have quite effectively proven the opposite of your position.

No you see: you are not allowed to talk about hings if other users think it's unproductive. Cease having fun immediately.

We have both moved as far from the original topic as possible.

Reply on news.ycombinator.com