I think the more interesting aspects of the xz exploit aren't even the technical ones but the social ones.
Like, this thing (https://github.com/google/oss-fuzz/pull/10667) where almost a year ago they convinced Google's fuzzing project not to run against xz with one of the mechanisms of the eventual attack enabled anymore is a brilliant(ly evil) move.
At this point it's hard to even rule out the possibility that the original maintainer was targeted for harassment (bad cops) to encourage him to give up maintainership of the project to a friendly newcomer (good cop).
It's such a long game.
Meg /
npub1cl…7snyh
2024-03-30 20:06:12
Author Public Key
npub1cl9cpf38v5r2l0a3aytl8krhmjfnmvs0f6xyrl6qtk8eufewkafsq7snyhSeen on
wss://relay.nostr.bandPublished at
2024-03-30 20:06:12Event JSON
{
"id": "4fc74d63e461f69e699431e3f78f2b2f0edb560f2ed2edb6db157ede3b9cd324",
"pubkey": "c7cb80a6276506afbfb1e917f3d877dc933db20f4e8c41ff405d8f9e272eb753",
"created_at": 1711829172,
"kind": 1,
"tags": [
[
"proxy",
"https://social.treehouse.systems/users/megmac/statuses/112186436680099413",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://social.treehouse.systems/users/megmac/statuses/112186436680099413",
"pink.momostr"
]
],
"content": "I think the more interesting aspects of the xz exploit aren't even the technical ones but the social ones.\n\nLike, this thing (https://github.com/google/oss-fuzz/pull/10667) where almost a year ago they convinced Google's fuzzing project not to run against xz with one of the mechanisms of the eventual attack enabled anymore is a brilliant(ly evil) move. \n\nAt this point it's hard to even rule out the possibility that the original maintainer was targeted for harassment (bad cops) to encourage him to give up maintainership of the project to a friendly newcomer (good cop). \n\nIt's such a long game.",
"sig": "e6fd03f219b50f800884e5eecf1a13d7113cf1603fdcf9bdf65ccfa145d8b1e0c293d36328dc4f5100124e6a3b37d36d98e483f37a2ebb64c2e7949942cc183a"
}