From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oa1-x2c.google.com (mail-oa1-x2c.google.com [IPv6:2001:4860:4864:20::2c]) by sourceware.org (Postfix) with ESMTPS id 044FD3858D28 for ; Tue, 2 Apr 2024 22:51:11 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 044FD3858D28 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 044FD3858D28 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2001:4860:4864:20::2c ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712098272; cv=none; b=m8nvK5JmTm/9SHD4WqyKumVak0e7hZUCQMPpEuOXdt7tgSo3/pIp8GDKOmylLutbbwr59B0VmmtJ4wjzb9C94j6U+hh1UYMtVmz/ZqReRcw3R3HkR5OxvX+w3uyod9pGtR9lKk04eeN2c7NDKSezBAHutlLus2YB8uKACSfldXI= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712098272; c=relaxed/simple; bh=TVvPezAO0ms9F0ihB+2VZ6kbpRZ3FRMeJ6yJHBBARzU=; h=DKIM-Signature:MIME-Version:From:Date:Message-ID:Subject:To; b=szm9iT/j/rD68lAn/lOfwfZh7reFk0Ac2HZ2cEijYX4z20yUKw+o7cM7nKAMZDU8OkenYfJGyMP2eQL4YQbgJtPO2mJSHB8H+8JjnndCsre5U3WibwoFZqEv8xAtwIONW5Dbij/2vQjbkG3UX6t+uV9oLQoZaokUZKxBjlJezXw= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-oa1-x2c.google.com with SMTP id 586e51a60fabf-22e8f64758cso214727fac.3 for ; Tue, 02 Apr 2024 15:51:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1712098269; x=1712703069; darn=gcc.gnu.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :reply-to:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=TVvPezAO0ms9F0ihB+2VZ6kbpRZ3FRMeJ6yJHBBARzU=; b=Vez6VWv2eKapxFnJYKgi58DLt9DBjR676lCDcPADFvqsVqCTDeCvgElCfITflxceDI trQ4Nvxa4bXBLlEc5t7YsE+BVoe52ro7HfDz6N6XjQN51yDJituSgf67xU6vIxGlCwOk eypaUyVRYA4m+L0ur2aumD2vhF0vBl1Obhhpig4bHuLpQTwiXUMn2u5hTtWhKvn4iBcS 4mdRWnq7OT+sr0HrJaSO8AaLhqEtq7lwRe9N3sq549ezewgcXOrl/SEVeA8zETsITRfM ynctQCc4DMGWPiotgQ/4c10S0D3RqbPdkjZe2GDTQgwLRDNHc8wkWiPjuOroMLoGr4jU dhZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712098269; x=1712703069; h=content-transfer-encoding:cc:to:subject:message-id:date:from :reply-to:in-reply-to:references:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=TVvPezAO0ms9F0ihB+2VZ6kbpRZ3FRMeJ6yJHBBARzU=; b=MQjyZYyf+7CuObY5/QB8yWGMO2suExqMO9SRLsYZ1JI2U1TqojhzF6mN/9C7VUfrAn vsB9FbcVsz+IRrKCzuWuOwDo558P3AWYiqEKguj4azQiHhqI/E237YM8GIpA+gtY/Rdv EYGIpUMjuWS2kIsI2x+Rd4HR7AYrZgWPJyekQOSV9dHCrfGu5W2arA2MCzXoZvZ7o5tm wcWanyG3WlHolCPVvjRqextTvhm3cP2zffvpNL/s6HP9z9C9hkKnOvR+aNDlhaSweDzE uvdPUsXwJYos4BdxNJgFbPbvbIhMkPNH8yq3k3afZUUU3KpuW2YyW3go7jTy6/TGMDfv d/EQ== X-Forwarded-Encrypted: i=1; AJvYcCWKXSwQ2fqiz961Nt8KP92fM/UijMQfC2pEsakl7VKG3VUbMwZ6BNeylu3PccVJ0fB/DiukB++CLo2g2x2rTkY= X-Gm-Message-State: AOJu0Yywo0iumZUa4LRJcCx4J2UbxwO6BUkv4leMP9X+gDGCxYyT7npg vs5JgtzdI4odAI1yyLNveBuo9QQoZiFh4yLqLygmT1v4+d0FFDn9oK1hUnErwF33107GhpJg8FK lokP+dPLXs/5CaEJkpL70VIk6dQ4= X-Google-Smtp-Source: AGHT+IHzt3X7uu/iD4Lb6WOjTMGH7X0oNg0Gt7NLC7LXTr/ym1g2hRPlrS95hnB+Xx4VFOAB5QmQL/HAevw1DJ7s+BY= X-Received: by 2002:a05:6870:a70e:b0:22a:97bf:366 with SMTP id g14-20020a056870a70e00b0022a97bf0366mr16125019oam.13.1712098268783; Tue, 02 Apr 2024 15:51:08 -0700 (PDT) MIME-Version: 1.0 References: <20240329203909.GS9427@gnu.wildebeest.org> <20240401150617.GF19478@gnu.wildebeest.org> <077b9dd5-0df1-4384-a9d1-58e4283caf09@redhat.com> In-Reply-To: <077b9dd5-0df1-4384-a9d1-58e4283caf09@redhat.com> Reply-To: noloader@gmail.com From: Jeffrey Walton Date: Tue, 2 Apr 2024 18:50:57 -0400 Message-ID: Subject: Re: Sourceware mitigating and preventing the next xz-backdoor To: Guinevere Larsen Cc: Sandra Loosemore , Mark Wielaard , overseers@sourceware.org, gcc@gcc.gnu.org, binutils@sourceware.org, gdb@sourceware.org, libc-alpha@sourceware.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-0.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On Tue, Apr 2, 2024 at 6:09=E2=80=AFPM Guinevere Larsen via Gdb wrote: > [...] > What likely happened for the maintainer who acted in bad faith was that > they entered the project with bad faith intent from the start - seeing > as they were only involved with the project for 2 years, and there was > much social pressure from fake email accounts for the single maintainer > of XZ to accept help. The infiltration appears to have started offline, earlier than June 2022. See = . > While we would obviously like to have more area maintainers and possibly > global maintainers to help spread the load, I don't think any of the > projects listed here are all that susceptible to the same type of social > engineering. For one, getting the same type of blanket approval would be > a much more involved process because we already have a reasonable amount > of people with those privileges, no one is dealing with burnout and > sassy customers saying we aren't doing enough. > > Beyond that, we (GDB) are already experimenting with approved-by, and I > think glibc was doing the same. That guarantees at least a second set of > eyes that analyzed and agreed with the patch, I don't think signed-off > would add more than that tag (even if security was not the reason why we > implemented them). Jeff