Hacker News Reader

Both.

Firstly im very cautious of any "single-dev" built side project, and when its closed source im even more aware of the dangers installing. And with russia in 2024 i cant trust any software produced over there. So, combine all three (close-source, single dev and russia) and you have a something really suspicious.

View on HN

Agree, my reasoning is the same - also for other countries like China...

What about the middle eastern countries? South America? That country that has the Patriot Act?

I'm looking forward to everyone uninstalling Nginx.

Nginx is open-source, so I don't see how this fits the description.

Yeah single devs usually have some sort of ulterior ad driven spyware motive.

The xz thing was just 10 days ago.

Google is everyday.

Dude acts as if when it’s open source he conducts a code audit before installing anything.

xz just proves how dumb this mindset actually is.

I'd say the opposite, xz proved how much effort it is to actually backdoor widely used open-source software as opposed to something where the Russian government (or another one) can just go knocking.

Nothing is perfect of course but the attack was insane in terms of complexity.

Im sure state level actors are building clones of old software with little network functionality to pwned people en mass.

Reply on news.ycombinator.com