Veritasium
1 HN recommender · recommended in 3 months, 2026
53:00 · 16M views · Feb 25, 2026
Veritasium tells the story of the XZ backdoor, how a patient attacker became maintainer and nearly compromised SSH on Linux systems. It also covers free software history and how encryption in SSH works.
Cited as an accessible, documentary-style account of the XZ backdoor in supply chain security discussions.
4 comments from Hacker News
Reminded me of a similar story at openSSH, wonderfully documented in a "Veritasium" episode , which was just fascinating to watch/listen. this video
Still no smoking gun, but possibly Russia. From the video this video : > A lot of the aliases, like Jia Tan, they sound like Asian names, and the published changes are all timestamped in UTC+8, Beijing time. So the signs point to China. And that's why it's probably not China. I mean, why would they make it that obvious? Every other part of the operation has been so meticulous, so cautious. > And they also worked on Chinese New Year, but not on Christmas. And over the years, there were nine changes that fall outside of the Beijing time into UTC+2, which is a time zone that includes Israel and parts of Western Russia. That's why some experts have speculated that this could be the work of APT29, a Russian-state-backed hacker group also known as Cozy Bear. But again, do we know? No, of course we don't know who it is, and we likely will never know.
Agreed. However, I often wonder if people like that are deliberately (or inadvertently) being a psyop seeking to burn out people ala how "Jia Tan" tried to become maintainer of xz [0]. [0] this video
Just to mention the original was cited in the most recent Veritasium video: "The Internet Was Weeks Away From Disaster and No One Knew" this video (at about the 9:50 mark)