The xz backdoor thing reminds me of a story

[jddj]

I remember a few months ago there was a discussion[1] here about how fossil, the VCS for sqlite, should bring in a dependency on mermaid charts already.

Nothing against mermaid, but I guess supply chain attacks are hard to conceptualise until they happen. When we're shortsighted we risk our mitigations against vague but serious threat models losing out against convenience.

[1]https://news.ycombinator.com/item?id=38886344

[roenxi]

Well... supply chain attacks are trivial to anticipate. A lot of modern programming (I'm thinking JavaScript especially when I say this) involves what seems to be 100s of dependencies. If there is a 1% chance of a random repo having a backdoor, the project will be compromised. That is clear and obvious.

The problem is that the people who act on this and minimise dependencies are at a significant economic disadvantage to those who don't. A project with high risk tolerance has to write a fraction of the code and solve a fraction of the problems as someone who carefully writes secure software.

The trade off isn't just "convenience", we're talking massive differentials in productivity that favour insecure models. It is much cheaper to accept that data will leak sooner or later, to the point where we can assume that if something is economically developed that is evidence it can't possibly be secure. That isn't an argument for more security though; if possible it is better to just design systems where leaks don't matter (eg, here in HN it isn't clear why I'd care about a leak - everything is already public except for the IP address in the server log).

[datascienced]

Could a plugin architecture accommodate this?

[dilyevsky]

There’s someone commenting on the thread saying a background check will uncover an illegal agent. That’s cute

[deathanatos]

Most of the details are out there but …

> in that he had apparently downloaded a copy of everything

… is a day in the office? I've done this, particularly at places that are "one repo == one project" organized (i.e., not monorepo): e.g., if I make a breaking change to a library, I'm going to update all the uses of that. Still to this day, the easiest way to do that is locally, with command line tooling.

[indrora]

If you look at the Nintendo Gigaleaks, you'll discover that most of Nintendo hardware had one single CVS (later SVN) repository that held everything. Same with BroadOn, even up into 2010, when the cvs backup was taken.

It's fairly well known that Google maintained a Stinky monorepo for a long time and one of the risks is someone just going and slurping the whole thing up onto a big enough drive and walking out the door.

[jonhohle]

Places with reasonable build systems can do that for you. For example, poudriere on FreeBSD.

[77pt77]

The next time something like this happens it will be a distribution packager (RedHat, arch, etc).

They'll just release a package that has extra code than a clean build from source.

[bandrami]

Reproducible builds can help in theory, but in practice you're always using the potentially-compromised system itself to reproduce the build

[renewiltord]

I don't doubt that this happened, but if you use e-verify and fill in Form I-9 how does this happen? I'm in the middle of hiring an F-1 student on OPT and I need to look at his EAD and verify it's not fake according to my lawyer. So I do. Nice and easy.

[greyface-]

Intelligence agencies can presumably mint valid SSNs along with other identity documents to use in situations like this.

[kortilla]

E verify was definitely not ubiquitous two decades ago. Even during Covid one of my friends didn’t have his new employer actually verify i9 docs until a year into employment…

[furyofantares]

It says it was a couple decades ago

[dboreham]

Attacker's opsec presumably takes this into account.

[curiousgal]

> None of his paychecks were ever cashed

I don't understand this. People were paid by cheque in the early 2000s?

[gumby]

Pretty common in the US back then. Direct deposit is (still) only required to be provided at the company's bank, though I doubt anyone implements that minimum any more.

Back in the 90s when I worked for Atari (Back in the terrible Warner period) you could only get DD at the company's bank, which was a small bank with one branch, in Sunnyvale (surely the company had another bank or two as well?). I was told they did this so they could invest the float over the week end and early in the week.

[astrange]

You don't have to give your employer a bank account number, but they still have to pay you.

Quite unusual for a tech contractor though.

[furyofantares]

I certainly got checks at internships in 1999-2000 and at a job I briefly held in 2001. I guess my first real-real job was 2006 and for sure I got checks for at least the first few months. It was a mild pain to do the (literal) paperwork for direct deposit, and a mild pain to receive checks (I'd categorize it as a major pain now, but you were running errands more often then and even at the bank for other crap), so laziness won for a while.

[nimih]

I had the option to be paid by paper check as recently as 2017, and probably still would if I had remained working for that employer (a US-based legacy insurance carrier).

[donatj]

Developer in the Midwest. I was paid by paper check brought to my desk by the office manager from early-aughts until 2012 when they switched to direct deposit.

[NelsonMinar]

I don't understand this. You go through all this trouble to build a fake identity and then you don't do this one simple thing to make sure you look like a real employee?

[leoh]

Yes and many still are

[77pt77]

Not from the US I guess?

They are still ubiquitous today, let alone in the early 2000s.

[dspillett]

I'd much rather this than needing to agree to hundreds of commercial entities eating my data and spreading it to [deity] knows how many more, or clicking hundreds of "legitimate interest in our position as a stalker" checkboxes to opt out, which is required for taking stuff using many other publishing options.

Requiring JS to read a simple article is undoubtedly wasteful, of course, but there are far worse insults you can make to you readership.

[astrange]

Was that before or after he told you people were hypnotizing you through the TV and tried to sell you nutritionally complete frozen burritos?

[smitty1e]

Tell HN: if the comment was somehow offensive, feedback on the specifics of the transgression would help to improve matters.

[leoh]

Ok