I found this Veratasium documentary on the xz Jia Tan backdoor adventure quite good and surprisingly detailed:

[thanius@mastodon.chuggybumba.com]

@bagder I'm confused to as why binary blobs are allowed to be stored in public source code repositories anyways.

I mean, I understand if you want to include assets for a game, but wouldn't it then be safer to store them in readable format before compression? As a simplified example, png's could be stored as xpm in source and then converted into the better format using provided tools, also in the repo.

Tldr being: If blobs are to be used in tests, write a tool that generates the blob for them.

[bagder@mastodon.social]

@FarmerDenzel yeah, I would probably even argue that they made it a little *too* detailed at the risk of getting people bored for a show geared towards "common people"

[thanius@mastodon.chuggybumba.com]

@infosec812 He is part of the whole story, though. Would be weird to leave him out, like a gap in the resume.

[farmerdenzel@infosec.exchange]

@bagder Yeah, I do sometimes have that complaint especially when I watch their videos on things I don’t know as much about (eg physics).

Sometimes feels like detail for the sake of demonstrating that the problem is complex rather than detail for the sake of teaching the viewer.

[solemarc@mastodon.social]

@thanius @bagder it is weird but it was done to test compression /decompression with known blobs (I think) and since it was always like this, no one thought twice. I'd guess this kind of thing is being much more heavily scrutinized now.

[bagder@mastodon.social]

@thanius convenience? lack of time? didn't think of the security implications?

Keeping everything readable all over takes effort. In the curl project the xz event kicked off a journey making sure we have less opaque data everywhere in git. It is work that is still ongoing!

[meuwese@mastodon.social]

@bagder I learned more than I would care to admit about how encryption works. And the RedHat admin was admirably candid about his role.

[michaelwhite_cpt@mastodon.social]

@bagder Interesting

[thanius@mastodon.chuggybumba.com]

@bagder Yeah, I understand it takes time to backtrack through an entire project or projects to make everything transparent for reviewers.

But after this debacle I hope that more developers look into dogfooding their binary storage in projects. I too am responsible for storing blobs, albeit in private repos, but I've since tried to implement build-time asset transformation instead even though it may bulk up the repos.

[tristan@sns.tcl.me]

@bagder Saw it today too. It had a really high production value, and was thoroughly explained. I’d even recommend it to my non-tech friends.

[peturdainn@mastodon.social]

@bagder I had up to now never seen the colour mixing analogy, quite like that.

Also, does this count as a rickroll?

[mlen@social.hackerspace.pl]

@bagder The name that the attacker used is likely fake. Unfortunately it happens to be the name of a person I used to work with that was not related to this backdoor at all. I know that they got harassed online because of that coincidence. When possible, I think it's better to omit the name or include a note that it's likely fake.

[gunstick@mastodon.opencloud.lu]

@FarmerDenzel @bagder several of their videos have quite some mathematical formulas in them. So I think their audience is not the less technical audience.