Hacker News Reader

Comment by brenoguim | Hacker News Reader

> It does not plausibly pass for a typo because no typical editing glitch will leave a '.' character there.

I would certainly attribute that to a typo if I was reviewing the code.

The point is that under casual review & in isolation, it's not hard to accept as a typo, but under closer review and knowing what we know now, it's almost certainly part of the attack.

We only know it's malicious in hindsight. If I was Lasse (original xz maintainer) I could have easily thought it was an innocent typo and that's the point. If it was more convoluted like zero-width Unicode character or misspelling of variable names, it'll be less plausible IMO.

The thing is, if anyone would have actually realized it (other than Jai) it would have been hopefully fixed. Like... no one would just see that and say "well, must have been a typo" and just leaves it.

You're missing the years of reputation Jia built so that he'd be given the benefit of the doubt. I don't think anyone would have been too suspicious.

I am not saying people would have said Jia is acting maliciously, just noone saw this to begin with else it would have been fixed in a separate patch (before the emergancy fix recently by Lasse)

XZ is just a really boring project. It seems complete for the most part, so I'm not surprised by the lack of scrutiny. It's one of these projects that I would just assume is well maintained.

> The syntax error is a single period '.' as the first character on an otherwise empty line of C code.

I believe the point is that given this context, it could/should not be construed as a typo.

If you received this patch from someone you trusted, and noticed the period, would you call it a typo or would you assume it is malicious?

Or is this just an argument over the use of the word "typo" instead of "mistake"? That wouldn't be very useful, IMO.

Very common if you copy paste (using mouse buffer) from midnight commander text editor or any other editor that highlights trailing spaces as dot.

I take it they're not forcing contributors to lint code, then?

Does your linter look for syntax errors in the content of strings? If so, how would you design a unit test meant to capture syntax errors?

Have you tried running lint on a configure.ac or CMakeLists.txt file?

For those using editors with mouse, it's very easy to add a character anywhere. Doesn't matter the place.

"." repeats the last command in vim, so I'd consider it quite plausible as a typo, if we didn't know about the rest of the stuff.

ed man! Ed uses a single . line to end input. You actually can't enter a single '.' (because that wound end your input) but "I was using vi and must have dropped into ex mode or something" on the surface sounds reasonable.

Reply on news.ycombinator.com