[HN Gopher] Discovering the xz backdoor with Andres Freund [audio]
___________________________________________________________________
Discovering the xz backdoor with Andres Freund [audio]
Author : ujeezy
Score : 85 points
Date : 2024-04-11 19:08 UTC (3 hours ago)
(HTM) web link (oxide.computer)
(TXT) w3m dump (oxide.computer)
| icambron wrote:
| I've only had a chance to listen to the beginning of it, but I
| share their disgust with the NYT article [1]. In any other field,
| journalists feel responsible for simplifying and explaining.
| Professionals in science, law, or medicine are often critical of
| these explanations, because the journalists' understanding of the
| relevant background material is often flawed, and the
| simplifications either ignore crucial distinctions or get the
| facts wrong. But they are at least trying, because the
| journalists understand that it's their responsibility to explain
| the issues at hand to the audience; that's the point. Instead,
| here we see a sort of flip shrug, with a "geek stuff, amirite?"
| wink. Obviously, there's a limit to the amount of technical
| detail a general-interest article can include, but it needn't
| deliver its elisions with a smirk, and I can't imagine any other
| subject area the NYT would approach that way.
|
| My brother, who is not in IT, sent me the article a few days ago.
| He was fascinated by the underlying story but frustrated with the
| article's tone and lack of explanation, so I'm confident this
| isn't just me suffering from a bout of Gell-Mann amnesia.
|
| [1] https://www.nytimes.com/2024/04/03/technology/prevent-
| cybera...
| newprint wrote:
| I spent 15y+ writing in C/C++/.NET and and I have hard time
| understanding what is going on with xz with all twists and
| turns, why you are expecting your brother to understand and NYT
| will give you clear explanation that laymen can understand this
| very intricate hack ?
| juliusdavies wrote:
| They are criticizing the journalist (Kevin Roose) because of
| this line from his NYTimes article:
|
| > "[Andres Freund's] job involves developing a piece of open-
| source database software known as PostgreSQL, whose details
| would probably bore you to tears if I could explain them
| correctly, which I can't."
|
| And that line doesn't matter at all for the purposes of
| understanding the "xz" attack. To me it's pretty innocuous and
| self-deprecating and makes sense for the general readership the
| NYTimes writes for.
| dralley wrote:
| It seems deeply unprofessional, personally.
| blast wrote:
| Is there a transcript?
| hammock wrote:
| https://pastebin.com/EpW5zZdJ
| ahl wrote:
| available here https://share.transistor.fm/s/e2538f7d
| blast wrote:
| I couldn't find a transcript on that page.
| codetrotter wrote:
| Click TRANSCRIPT.
|
| Sorry - I'm not shouting, it's literally in all-caps on
| that page :^)
|
| Here's a screenshot to show you where to click:
| https://i.imgur.com/MZ37jhD.png
| ChrisArchitect wrote:
| [dupe]
|
| Some more: https://news.ycombinator.com/item?id=39985643
| rcarmo wrote:
| I have this queued up to listen tomorrow and fully expect it to
| be stellar. Oxide podcasts have always been a highlight of my
| week (and almost restore my faith in the industry, because
| someone, somewhere, is _right_ about the way they develop and
| integrate product).
| hwbunny wrote:
| There were like 55 articles about this. People are this famished
| for some action?
___________________________________________________________________
(page generated 2024-04-11 23:01 UTC)