I found this Veratasium documentary on the xz Jia Tan backdoor adventure quite good and surprisingly detailed:

[infosec812@foojay.social]

@bagder I wish they had left Stallman out of it though. He's a very problematic figure. While I do not discount the contributions he has made to Open Source and Free Software, his "other" public statements make me stay far away from everything to do with him.

[farmerdenzel@infosec.exchange]

@bagder I actually spent some time talking the writers of that video through the technical details of the backdoor, since they came across my talk about it just after it was discovered.

I think the video is definitely a bit dramatic and geared towards a less technical (or at least less cyber-focused) audience, but was impressed with how much they cared about getting the minutiae right.

Realistically, most of their viewers won’t care about ifunc or dynamic linker audit hooks, but it does keep things interesting for the cyber folks watching.

[thanius@mastodon.chuggybumba.com]

@bagder I'm confused to as why binary blobs are allowed to be stored in public source code repositories anyways.

I mean, I understand if you want to include assets for a game, but wouldn't it then be safer to store them in readable format before compression? As a simplified example, png's could be stored as xpm in source and then converted into the better format using provided tools, also in the repo.

Tldr being: If blobs are to be used in tests, write a tool that generates the blob for them.

[bagder@mastodon.social]

@FarmerDenzel yeah, I would probably even argue that they made it a little *too* detailed at the risk of getting people bored for a show geared towards "common people"

[thanius@mastodon.chuggybumba.com]

@infosec812 He is part of the whole story, though. Would be weird to leave him out, like a gap in the resume.

[farmerdenzel@infosec.exchange]

@bagder Yeah, I do sometimes have that complaint especially when I watch their videos on things I don’t know as much about (eg physics).

Sometimes feels like detail for the sake of demonstrating that the problem is complex rather than detail for the sake of teaching the viewer.

[solemarc@mastodon.social]

@thanius @bagder it is weird but it was done to test compression /decompression with known blobs (I think) and since it was always like this, no one thought twice. I'd guess this kind of thing is being much more heavily scrutinized now.

[bagder@mastodon.social]

@thanius convenience? lack of time? didn't think of the security implications?

Keeping everything readable all over takes effort. In the curl project the xz event kicked off a journey making sure we have less opaque data everywhere in git. It is work that is still ongoing!

[meuwese@mastodon.social]

@bagder I learned more than I would care to admit about how encryption works. And the RedHat admin was admirably candid about his role.

[michaelwhite_cpt@mastodon.social]

@bagder Interesting

[thanius@mastodon.chuggybumba.com]

@bagder Yeah, I understand it takes time to backtrack through an entire project or projects to make everything transparent for reviewers.

But after this debacle I hope that more developers look into dogfooding their binary storage in projects. I too am responsible for storing blobs, albeit in private repos, but I've since tried to implement build-time asset transformation instead even though it may bulk up the repos.

[tristan@sns.tcl.me]

@bagder Saw it today too. It had a really high production value, and was thoroughly explained. I’d even recommend it to my non-tech friends.

[peturdainn@mastodon.social]

@bagder I had up to now never seen the colour mixing analogy, quite like that.

Also, does this count as a rickroll?

[mlen@social.hackerspace.pl]

@bagder The name that the attacker used is likely fake. Unfortunately it happens to be the name of a person I used to work with that was not related to this backdoor at all. I know that they got harassed online because of that coincidence. When possible, I think it's better to omit the name or include a note that it's likely fake.

[gunstick@mastodon.opencloud.lu]

@FarmerDenzel @bagder several of their videos have quite some mathematical formulas in them. So I think their audience is not the less technical audience.