Hacker News Reader

> There was a bit of a kerfuffle (https://www.openwall.com/lists/oss-security/2024/03/29/4) about subverting open source projects recently

> [...]

> A well established identity on the internet creates a form of inner piece

Worth noting that the motivating incident (xz backdoor) was a user with legitimate history under what at the time appeared to be a real name. Even mandatory ID verification may not have helped in this case, if they're a state actor.

View on HN

But, if they had presented such a passport, we would know they were a state actor. Or at least be able to assume it to a much more reasonable degree.

And what difference does that make - Really?

it increases the cost for the attacker, forging ID is expensive and against the law. It also leaves behind additional evidence that might be useful to investigators

The attacker wasn’t a random kid having fun. If they have the resources to do this kind of attack, they can definitely forge IDs.

Really? Organized crime also produces fake documents, and they are sold/smuggled to independent actors constantly.

Plus, identity theft is not an uncommon crime.

Reply on news.ycombinator.com