Rob Allen / is on Nostr

Freelance API and web consultant based in Worcester, UK. OSS contributor. Takes photos for fun. He/him.

Web: https://akrabat.com
Flickr: https://flickr.com/akrabat
Twitter: https://twitter.com/akrabat
Previously: https://phpc.social/@akrabat

Last Notes

2024-03-30 15:42:22

- reply

I could reasonably argue that our entire society is based on trust. Crime happens because that trust is abused.
Security is hard because it’s not entirely a technical problem.

2024-03-30 15:42:22

- reply

I could reasonably argue that our entire society is based on trust. Crime happens because that trust is abused.
Security is hard because it’s not entirely a technical problem.

2024-03-30 15:20:57

- reply

Regardless of whether the maintainer is paid or if there is a team of maintainers, humans trust people that they think they know.
Hence, a project is likely to trust someone who’s been around the project for a while.
Similarly, a company is likely to trust a senior dev who’s been around a while.
xz is as much a social engineering attack as it is a technical one.

2024-03-30 15:20:57

- reply

2024-03-30 15:03:16

- reply

For small projects, there are too few regular contributors too.

2024-03-30 15:03:16

- reply

For small projects, there are too few regular contributors too.

2024-03-30 12:42:59

The interesting thing about the xz attack is that as humans we tend to trust after time has passed.
A senior dev starts working for a company in 2021 is a trusted senior dev by 2024.
Someone starts regularly contributing to an OSS project in 2021 is a maintainer by 2024.
xz is as much a social engineering attack as it is a technical one.
#xz

2024-03-30 12:42:59