boehs is a developer who writes on security incidents, privacy, open source licensing, RSS, and the effects of LLMs on the web.
HN cites its XZ backdoor write-up, which commenters use to discuss the maintainer timeline and suspicious accounts, and a post on private Apple APIs.
My takeaways:
First from the article itself:
>"At this point Lasse seems to have started working even more closely with Jia Tan. Evan Boehs observes that Jigar Kumar and Dennis Ens both had nameNNN@mailhost email addresses that never appeared elsewhere on the internet, nor again in xz-devel."
That is an important observation!
Takeaway: Most non-agenda driven actual people on the Internet, leave a trail -- an actual trail of social media and other posts (and connected friends) that could be independently verified by system/social media/website administrators via voice or video calls (as opposed to CAPTCHA or other computer-based "Is it a human?" tests, which can be gamed) for stronger confidences in the identity / trustworthiness of the remote individual at the other end of a given account...
Next takeaway from the linked article: (https://boehs.org/node/everything-i-know-about-the-xz-backdoor):
>"AndresFreundTec @AndresFreundTec@mastodon.social writes:
Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd,
showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol.
Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates."
Takeaway: We could always use more observability of where exactly CPU time is spent in given programs...
Binaries without symbol tables (which is the majority…
One of the primary responsibilities of a maintainer is to ensure the security of the software. If they can't keep up with the pace of development in order to ensure this for their users, then this should be made clear to the community, and a decision should be made about how to proceed. Open source maintenance is an often stressful and thankless role, but this is part of the problem that allowed this to happen. Sure, a sophisticated attacker would be able to fool the eyes of a single tired maintainer, but the chances of that happening are much smaller if there's a stringent high bar of minimum quality, and at least one maintainer understands the code that is being merged in. Change proposals should never be blindly approved, regardless of who they come from.
At the end of the day we have to be able to answer why this happened, and how we can prevent it from happening again. It's not about pointing fingers, but about improving the process.
BTW, there have been several attempts at introducing backdoors in the Linux kernel. Some manage to go through, and perhaps we don't know about others, but many were thwarted due to the extreme vigilance of maintainers. Thankfully so, as everyone is well aware of how critical the project is. I'm not saying that all projects have the resources and visibility of Linux, but clearly vigilance is a requirement for lowering the chances of this happening.
> That's assuming a maintainer wasn't compromised, like in this case.
What makes you say…
> It's naive to believe that any form of physical presence means someone isn't going to do something nefarious in the eyes of the project.
It's not the only thing, but it is something.
There's a lot of social engineering that went into the xz backdoor[0]. This started years ago; Jia Tan was posting in projects and suddenly someone appeared to pressure projects to accept their code. Who's Jia Tan? Who's Jigar Kumar, the person who is pressuring others to accept patches from Jia Tan? We don't know. Probably some person or group sponsored by a state APT, but we don't know for sure, because they're currently just text on a screen.
Having this person or group of people have to continually commit to the bit of publicly-known open-source maintainer who attends conferences, has an actual face, and is on security camera footage at multiple hotels and airports is far, far harder than just talking a vulnerable person into allowing maintainer access on a repository. Making them show up to different places a few times adds a layer of identity. Otherwise these "skilled eyes" could be anyone with a wide variety of motivations.
[0]https://boehs.org/node/everything-i-know-about-the-xz-backdoor
GMT+8, the name (Mandarin/mixed-dialect first name + Hokkien surname) and most importantly the circumstance that the user was seen connecting from a likely VPN exit or hosted server in Singapore [1] are all consistent with a Singaporean identity, whether real or cover. For that reason, the opinion of [1]'s source that the name sounds fake should also be taken with some amount of salt (Mainland Chinese are not always well-informed about Diaspora Chinese communities). Worth noting that many of the holidays mentioned, likewise, are not public holidays in SG [2] - Jan 24th was, but Jan 22nd (listed as working) was a Sunday, inconsistent with a "working on regular working days" pattern most anywhere.
Would be interesting to see a greater corpus of Jia Tan's writings, especially older ones. There are fairly distinctive idiosyncrasies that may be used to distinguish Singaporeans, Mainland Chinese and speakers of various Slavic languages (and Anglo natives).
[1] https://boehs.org/node/everything-i-know-about-the-xz-backdoor
[2] https://www.mom.gov.sg/employment-practices/public-holidays
I wish this were true too but it doesn't appear that llms.txt is meant to be a markdown version of the site's content based on the example on the site and after peeking at a few llms.txt files on some of the sites in the directory.
It looks like its text meant to be fed into the llm as a system prompt specific to the site.
The most simple ones just look like a sitemap restricted to documentation: https://www.activepieces.com/docs/llms.txt
Some interesting stuff is in some of them. Like this one that prompts the LLM to explain to the user the ethical issues of using AI agents along with a disclaimer:
https://boehs.org/llms.txt
That site appears to be someone's blog and they don't seem like big fans of LLMs.
https://boehs.org/node/llms-destroying-internet
A pretty clever use of llms.txt.
> Typical garbage argument based on the notion that open source developers are only doing it for the chance of employment.
There is nothing in the article that supports you making this statement. It's not clear to be that you understood the arguments the author was making.
The core of the argument is this:
> But, in light of the recent xz Utils / SSH backdoor scandal, it is clear that while the bargain may not be entirely one-sided, it is not symmetrical, and significant bad consequences may result, both for the maintainers themselves and for society.
Specifically the potential impact to society via scenarios similar to the above.
The link from the article covers it well:
https://boehs.org/node/everything-i-know-about-the-xz-backdoor