Posts from 1 April 2024

Content warning: my take on the xz backdoor

Attached: 1 image One of my friends from $BIRBSITE posted this and I am dyingggggggg

That sound you hear is a flurry of people asking ChatGPT to write a business plan to monetize the XZ incident.

Corollary: Your adversaries' SBOMs and dependency graphs *for your infrastructure* are better than yours.

tech companies donate their april fools’ day joke budget to open source maintainers challenge 2024

When Elon Musk, JK Rowling and the cops are unhappy, you know it’s a good law that will protect people. https://www.bbc.co.uk/news/uk-scotland-68703684

Polite reminder about the Jia Tan XZ hack: if an organization is so well run and well funded that it's able to play that long a game to that degree of depth and sophistication, that organization does not have all its eggs in one basket.

There’s a combo hot take brewing in my head about the #xz and #redis debacles. It goes something like: When the shit hits the fan and part of the reason appears to be an overworked and underpaid maintainer, lots of people come out of the woodwork to demand more respect and money for them. But when a maintainer recognizes that they’re in an unsustainable situation and dares to make a proactive change, well FUCK THAT GUY. WHO THE HELL DOES HE THINK HE IS?