I'm sorry but no. If you are responsible for the worst backdoor in recent computing history (which is probably a criminal act in nature), then you do have a responsibility to explain what went down. Maybe he can take a couple days to write it but I think more than that would be irresponsible. Collin is partially responsible because he gave the keys to Jia Tan. I don't want to burn him at the stake since he's a victim too but I think it's reasonable to expect him to help clean up this mess and at least help us fill in the gaps and understand what happened.
Think about it this way. Say you are volunteering for a non-profit. You obviously don't have to do it and could just chill at home instead. But once you have agreed to say take a volunteer shift on Saturday, you are obligated to show up. Obviously no one can really stop you from skipping, but it would look bad on you and may get you banned from the non-profit. Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients. If you accidentally set the building on fire which ends up killing 5 people, I would also assume you would help in some fashion to clean up.
Just because you are doing things for free does not mean you don't have social responsibility for your actions. You don't have to work, but just saying "oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that). Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology.
Just want to point out that this isn't a typical "demand underpaid open source developers to work 24/7" issue here. This is a unique circumstance where his action has directly resulted in this happening. I feel bad for him being guilt-tripped to add a maintainer after reading through the old threads two years ago, and as I said I don't want to burn him at the stake, just saying that saying he has no responsibility to help at all is really a bad take.
Some important context here is that Lasse Collin posted the LKML message and the web page on Saturday the 30th, so while the topmost comment argues that he had no obligation to respond promptly, he nevertheless did respond promptly.
has no responsibility to help at all is really a bad take.
He has no responsibility to help at all.
All of the work done is that of a donation. Everyone who used xz did so for their benefit. Collin may feel a personal duty to work in the interests of the users of xz, but that's their exclusive choice. Any claim otherwise is on par with saying required-donation.
"oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that).
Then why mention it at all? But even if you did want to say that, that's true! You don't blame the victim of some abuse. Everyone, you included (assuming you use xz in anyway) were lied to. Just because Collin was lied to first, and most, doesn't change the fact the person who did all of the important work was also lied to and betrayed.
Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology.
Personally I'd be neither pissed, nor would I expect an apology. Shitty people are gonna be shit. But your mistake is blaming Collin for 'introducing' you to the person that slapped you in the face. But you're arguing as if Collin should have known this guy was a shitbag, and should hold the icepack while you berate them for making the mistake of trying to help other people... wtf?!
This us vs ourselves toxicity needs to stop. It's not us vs us. It's not even us vs the them. It's us vs the problem, us vs the malicious. The person writing the code is the good guy here.
...non-profit... no one can really stop you from skipping, but it would look bad on you
No it won't. Unless you have obligations.
Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients.
That's unrelated, to say the least. You obviously shouldn't steal from anyone nor beat up anyone, that's not related to this specific case at all.
Just because you are doing things for free does not mean you don't have social responsibility for your actions.
No. No one forced the society to use the work that somebody was doing for free. And if society decided that it's fine to use it, it's on the society to take the associated risks. Everything else is a good will of the maintainer.
The stealing part is related because in this case, his project is "stealing" (or injecting a backdoor"). Does that make the analogy clearer?
To be exact, he didn't do it specifically, but the non-profit is usually locked but he unlocked the door to let someone in and that person ended up stealing from the non-profit.
I really don't understand why people do not see that if you cause a giant mess, you have some responsibility to clean up after yourself. Again, I'm not saying that they should be obligated to do work. But this isn't "working". This is cleaning up an issue that you have caused.
No. No one forced the society to use the work that somebody was doing for free. And if society decided that it's fine to use it, it's on the society to take the associated risks. Everything else is a good will of the maintainer.
If I voluntarily baked a cake for you for free because I was nice and I mistakenly poisoned you, would you say "Oh i decided to take the risk of eating your cake anyway, not your fault"?
I didn't have to bake the cake. But since I decided to, I have basic obligations including not putting poison in it.
You are confusing legal and societal obligations, again. OpenSource maintainers and coders don’t owe you anything, so please stop pretending that they do.
I'm not confused about it. I never said Collin is legally liable to help. I'm talking about societal obligations here. Just because you do something for free doesn't mean your actions don't have consequences.
Yes you are, when talking about the poisoned cake. Poisoning it is a crime.
because you do something for free doesn't mean your actions don't have consequences.
Of course there are consequences - society is a closed system. Though it doesn’t give you ANY right to demand anything from the person who you didn’t pay to, directly or indirectly. Stop juggling the facts and whining, no one owes you anything, as I already said.
I won't say it's the worst one (assuming the attacker's private key is not public), just one of the most interesting ones in regards to the social engineering, pressure applied, code hidden in the test files etc.
I would say it's definitely the most interesting one we know about so far :)
Is it because thousands of companies and millions of users depend on it?
On one guy on holiday working for free!
When we are essentially in two cold wars currently with ICBM nuclear powers?
Linux is the battleground of cyber warfare, which is being funded by nations probably in the hundreds of billions of dollars. A trillion dollars or more of economic activity runs on it
Windows? Come on, even buggier and less secure, and far less transparent.
Monetary support of Linux maintainers is now a national security concern. You can't have hundred billions for attack and zero dollars for defense, that is a stupid strategy.
Comments
I'm sorry but no. If you are responsible for the worst backdoor in recent computing history (which is probably a criminal act in nature), then you do have a responsibility to explain what went down. Maybe he can take a couple days to write it but I think more than that would be irresponsible. Collin is partially responsible because he gave the keys to Jia Tan. I don't want to burn him at the stake since he's a victim too but I think it's reasonable to expect him to help clean up this mess and at least help us fill in the gaps and understand what happened.
Think about it this way. Say you are volunteering for a non-profit. You obviously don't have to do it and could just chill at home instead. But once you have agreed to say take a volunteer shift on Saturday, you are obligated to show up. Obviously no one can really stop you from skipping, but it would look bad on you and may get you banned from the non-profit. Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients. If you accidentally set the building on fire which ends up killing 5 people, I would also assume you would help in some fashion to clean up.
Just because you are doing things for free does not mean you don't have social responsibility for your actions. You don't have to work, but just saying "oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that). Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology.
Just want to point out that this isn't a typical "demand underpaid open source developers to work 24/7" issue here. This is a unique circumstance where his action has directly resulted in this happening. I feel bad for him being guilt-tripped to add a maintainer after reading through the old threads two years ago, and as I said I don't want to burn him at the stake, just saying that saying he has no responsibility to help at all is really a bad take.
Some important context here is that Lasse Collin posted the LKML message and the web page on Saturday the 30th, so while the topmost comment argues that he had no obligation to respond promptly, he nevertheless did respond promptly.
He has no responsibility to help at all.
All of the work done is that of a donation. Everyone who used xz did so for their benefit. Collin may feel a personal duty to work in the interests of the users of xz, but that's their exclusive choice. Any claim otherwise is on par with saying required-donation.
Then why mention it at all? But even if you did want to say that, that's true! You don't blame the victim of some abuse. Everyone, you included (assuming you use xz in anyway) were lied to. Just because Collin was lied to first, and most, doesn't change the fact the person who did all of the important work was also lied to and betrayed.
Personally I'd be neither pissed, nor would I expect an apology. Shitty people are gonna be shit. But your mistake is blaming Collin for 'introducing' you to the person that slapped you in the face. But you're arguing as if Collin should have known this guy was a shitbag, and should hold the icepack while you berate them for making the mistake of trying to help other people... wtf?!
This us vs ourselves toxicity needs to stop. It's not us vs us. It's not even us vs the them. It's us vs the problem, us vs the malicious. The person writing the code is the good guy here.
No it won't. Unless you have obligations.
That's unrelated, to say the least. You obviously shouldn't steal from anyone nor beat up anyone, that's not related to this specific case at all.
No. No one forced the society to use the work that somebody was doing for free. And if society decided that it's fine to use it, it's on the society to take the associated risks. Everything else is a good will of the maintainer.
The stealing part is related because in this case, his project is "stealing" (or injecting a backdoor"). Does that make the analogy clearer?
To be exact, he didn't do it specifically, but the non-profit is usually locked but he unlocked the door to let someone in and that person ended up stealing from the non-profit.
I really don't understand why people do not see that if you cause a giant mess, you have some responsibility to clean up after yourself. Again, I'm not saying that they should be obligated to do work. But this isn't "working". This is cleaning up an issue that you have caused.
If I voluntarily baked a cake for you for free because I was nice and I mistakenly poisoned you, would you say "Oh i decided to take the risk of eating your cake anyway, not your fault"?
I didn't have to bake the cake. But since I decided to, I have basic obligations including not putting poison in it.
You are confusing legal and societal obligations, again. OpenSource maintainers and coders don’t owe you anything, so please stop pretending that they do.
I'm not confused about it. I never said Collin is legally liable to help. I'm talking about societal obligations here. Just because you do something for free doesn't mean your actions don't have consequences.
Yes you are, when talking about the poisoned cake. Poisoning it is a crime.
Of course there are consequences - society is a closed system. Though it doesn’t give you ANY right to demand anything from the person who you didn’t pay to, directly or indirectly. Stop juggling the facts and whining, no one owes you anything, as I already said.
I won't say it's the worst one (assuming the attacker's private key is not public), just one of the most interesting ones in regards to the social engineering, pressure applied, code hidden in the test files etc.
I would say it's definitely the most interesting one we know about so far :)
Nope.
Dissect "worst backdoor EVAR". Why is it bad?
Is it because thousands of companies and millions of users depend on it?
On one guy on holiday working for free!
When we are essentially in two cold wars currently with ICBM nuclear powers?
Linux is the battleground of cyber warfare, which is being funded by nations probably in the hundreds of billions of dollars. A trillion dollars or more of economic activity runs on it
Windows? Come on, even buggier and less secure, and far less transparent.
Monetary support of Linux maintainers is now a national security concern. You can't have hundred billions for attack and zero dollars for defense, that is a stupid strategy.