Thought this was a good read exploring some how the “how and why” including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

  • Ephera
    link
    fedilink
    1311 year ago

    Pretty bad is also that it intersects with another problem: Bus factor.

    Having just one person as maintainer of a library is pretty bad. All it takes is one accident and no one knows how to maintain it.
    So, you’re encouraged to add more maintainers to your project.

    But yeah, who do you add, if it’s a security-critical project? Unless you happen to have a friend that wants to get in on it, you’re basically always picking a stranger.

    • DigitalDilemma
      link
      fedilink
      221 year ago

      I think bus factor would be a lot easier to cope with than a slowly progressing, semi-abandoned project and a White Knight saviour.

      In a complete loss of a sole maintainer, then it should be possible to fork and continue a project. That does require a number of things, not least a reliable person who understands the codebase and is willing to undertake it. Then the distros need to approve and change potentially thousands of packages that rely upon the project as a dependency.

      Maybe, before a library or any software gets accepted into a distro, that distro does more due diligence to ensure it’s a sustainable project and meets requirements like a solid ownership?

      The inherited debt from existing projects would be massive, and perhaps this is largely covered already - I’ve never tried to get a distro to accept my software.

      Nothing I’ve seen would completely avoid risk. Blackmail upon an existing developer is not impossible to imagine. Even in this case, perhaps the new developer in xz started with pure intentions and they got personally compromised later? (I don’t seriously think that is the case here though - this feels very much state sponsored and very well planned)

      It’s good we’re asking these questions. None of them are new, but the importance is ever increasing.

      • @taladar@sh.itjust.works
        link
        fedilink
        61 year ago

        Maybe, before a library or any software gets accepted into a distro, that distro does more due diligence to ensure it’s a sustainable project and meets requirements like a solid ownership?

        And who is supposed to do that work? How do you know you can trust them?

        • DigitalDilemma
          link
          fedilink
          21 year ago

          Fair point.

          If the distro team is compromised, then that leaves all their users open too. I’d hope that didn’t happen, but you’re right, it’s possible.