Hacker News Reader

Why do we assume the person building the trust is the attacker ?

Is not possible the attacker simply took over the account of some one genuinely getting involved in the community either hacked or just with $5 wrench and then committed the malicious code ?

View on HN

> Is not possible the attacker simply took over the account of some one genuinely getting involved in the community either hacked or just with $5 wrench and then committed the malicious code ?

Given the behavior of the accounts that applied pressure on the original xz maintainer, this seems unlikely to me.

Or they just bought the guy at one point, because I understood the malicious behaviour started quite recently.

Jia Tan's very first commit two years ago made suspicious changes to liblzma. See the timeline here: https://boehs.org/node/everything-i-know-about-the-xz-backdo...

Reply on news.ycombinator.com