A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
- Free and Open Source Software
- Programming
- Operating Systems
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
Moderators
PieFed
Five@slrpnk.net
edited 8 months ago
i have heard it suggested that it could be national goverment who did this. so that means it could be israel, america, or china, etc .
i view this as potentially very well funded governments vs ordinary people. we never stood a chance.
That suggestion is because the attack took years of ground work, psyops, multiple disciplines and several levels of obfuscations. It needs the kind of effort that only a well paid and dedicated team can pull off. But that need not necessarily be a state actor. It could also be some spying/malware company (like NSO), any of the big corporates or a criminal group with lots of money.
But don't lose hope. All it took to uncover all of that was just one engineer who was annoyed by SSH slowing down from 0.3s to 0.8s. The effort needed to uncover it is only a fraction of what's needed to hide it. This is also a vindication of the FOSS philosophy. Imagine uncovering this if the source wasn't available.
I wonder if the intention could be purely financial as well: Once the backdoor is in, you can sell it for millions to a company which sells the service of breaking into systems. Or it was such a company itself that pushed the backdoor into the code.
I guess even QubesOS would have been affected by this?