but also what the xz debacle shows: open source software is really hard to secretly backdoorbecause some rando will be like “huh, this command is taking 0.5 seconds longer than it used to, let me check what’s going on here”like can you believe that tha...

skze :nonbinary_flag:

people actually do that. if the code is available, they are going to look at it for any number of unpredictable reasons.

skze :nonbinary_flag:

@quasar how so?

forestry-quasar

@skye like, most engineers that arent red hat, microsoft whatever would see a 100x increase in latency and think "whatever, not my problem, im not paid enough for that"

Irenes (many)

@quasar @skye it was one of the core postgres people, so probably also just an unusually diligent person on all fronts

forestry-quasar

@irenes @skye huh, i thought it was some red hat person

Irenes (many)

@quasar @skye that was the first public announcement of it, early this morning, but the discoverer tooted about it shortly after

Irenes (many)

@quasar @skye behind the scenes the postgres person realized this was an inside attack of some sort and ignored the usual practice of reporting the bug to the xz project, instead reporting it to security people at distros (presumably mostly redhat), so that disclosure could be handled in a coordinated way. that was a particularly sharp move.

Irenes (many)

@quasar @skye we're tired though, please don't take our word on details of this nature right now. we were very careful about fact check on our remarks earlier today but it's been a long day and we can't keep that up forever...

skze :nonbinary_flag:

@irenes @quasar oh what’s their @?

Irenes (many)

@skye @quasar https://mastodon.social/@AndresFreundTec/112180083704606941

skze :nonbinary_flag:

oh god my point is not “open source always secure” it’s “open source much harder to secretly backdoor than closed source”