Timeline for Why has my upvoted answer about xz been silently deleted?
Current License: CC BY-SA 4.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 12 at 18:15 | comment | added | kos | @BeastOfCaerbannog Ok I apologize, I misred that statement, but yeah that's what I meant, besides the statement I misred, you're also making it clear in the first statement that you "strongly disagree" both with the deletion and with how the deletion was handled; so it seems as though you're advocating against an "unjust" ("unjust" as in "not warranted" rather than as in "improperly enforced") deletion as well. Which in turn comes across as supporting the answer be present on the site. You see what I mean? | |
| Apr 12 at 11:24 | comment | added | BeastOfCaerbannog | I don't object to the safety concerns, but I don't think the way that the way the answer was deleted is appropriate. I tried to put my main focus on the handling of the post by the mod (maybe not so clearly) while you focus more on the content of the question. I | |
| Apr 12 at 11:21 | comment | added | BeastOfCaerbannog | @kos I said "is not problematic, since the OP is primarily concerned if an LTS is affected", which is true, but I get your point. I could reword that, and probably will do. The mention for 24.04 is for being acceptable as an answer that doesn't justify deletion. If the OP was specifically asking about LTS, userunknown's answer will be okay as a direct answer without even needing an edit, although the same concerns would still apply and it would be better if another command to check the version was used. Which I also suggested. | |
| Apr 12 at 11:10 | comment | added | kos | @BeastOfCaerbannog I mean, it's their answer, they can write whatever they want in it and if the community stance is to keep the answer as it is, so be it; but as it stands, without any added usefulness past the initial "No" and beyond what other answers were providing, to me, the (tiny) risk in keeping the answer still outweights the (non-existent) benefit, overall leading to a net-negative. Making it better as deleted. Again, just my 2 cents. | |
| Apr 12 at 11:10 | comment | added | kos |
@BeastOfCaerbannog And still to this date their answer doesn't even remotely mentions the smallest, tiniest chance of worsening things by running that command, and I wonder why; multiple users have pointed out that it could be unsafe to run, yet it seems to me that OP doesn't want to acknowledge not even this (again) small, tiny chance, argumenting their lack of an acknowledge in (to me) unreasonable ways such as "then you might as well think that strings or apt-cache have been compromised".
|
|
| Apr 12 at 10:59 | comment | added | kos | @BeastOfCaerbannog Well that I agree with, the problem is that you're saying this in your answer: "In my opinion your suggestion of running the xz --version command is not problematic", which is a stance I don't want to associate with; furthermore, as I explained in my answer, I also think that " if the OP was concerned specifically about 24.04, then their question would be off-topic and would get closed." is kind of irrelevant in the bigger scheme, because ultimately also 24.04 users / users running other distros altoghether will still stumble upon the answer. You see what I mean? | |
| Apr 12 at 10:48 | comment | added | BeastOfCaerbannog | @kos I said that "I strongly disagree both with the mod's decision to delete the post and with the way the post was handled" because I believe that the deletion wouldn't be required if the OP was told about the issue with their answer in the first place, and because even if the post was deleted but the mod had explained the deletion reason, there would be no hard objection from my part and likely from the OP too. See also my comment to @muru. | |
| Apr 12 at 9:13 | comment | added | kos | @userunknown That been said, mods don't have to comment. But again, I agree leaving a comment with a reason there (IMO) made a lot of sense, cause ultimately it's not spam and the reason why the deletion was happening wasn't obvious. | |
| Apr 12 at 9:08 | comment | added | kos | @userunknown You've done the right thing coming on meta and bringing up the poor handling of the deletion; as a matter of fact I upvoted your question, because you have a fair point there, and I, too, think that letting you know why the deletion was happening was due. But since the top answer "strongly disagrees" with the deletion, I felt like bringing up that the deletion itself wasn't unreasonable (and that, as a matter of fact, I too think that answer is not needed considering that, at least to me, the risks outweigh the benefits). I guess we'll have to agree to disagree | |
| Apr 12 at 6:13 | comment | added | user unknown | And we know a lot about this carefully crafted backdoor and it seems to be a universal backdoor, useful for a whole lot of things to harm others. We should use this incomplete knowledge in estimating, how big the chances are, that there is in fact a second attack vector, and my estimation is, that it is very, very low, since this would increase the risk of getting detected, rendering this beautiful time bomb useless. Your estimation seems to vary, which is a legitimate position to hold, but I don't think it was legitimating the deletion of my answer. | |
| Apr 12 at 6:07 | comment | added | user unknown | … The one which would visit AU and blindly repeat the command would, as far as we know, only do harm to his system, which would have been happened already if he was running it for a few day in combination with systemd/sshd. I'm not claiming that my advice is the best and most careful one, you could do. I'm just defending it against silently deleting it without giving me the chance to improve it or to defend it. I didn't know that I don't get notified if a post of mine is deleted and find it super unfriendly to do so. You may threat spammers like that or obviously harmful advices or vandalism, | |
| Apr 12 at 5:54 | comment | added | user unknown |
I never suggested to prefer xz --version over other suggestions for testing the version. I never claimed that it is a 100% secure thing to do. But there is no indication that there is second attack vector and the command has been tested by other people and correctly revealed its version version number, which would make those, who are affected, aware of the problem. I guess we agree on the advice, not to run testing versions of Ubuntu in production but we know, that not everyone follows such advice. How good are my chances in a posting on AU to convince a person to change their behaviour? …
|
|
| Apr 11 at 23:33 | comment | added | kos | "Let's not check binaries used for tests because whoever would exploit them to backdoor the release executable"? Have we not learned anything from this? I find assuming hooking into lzma at all be 100% safe, in this scenario, naive at best. That been said, yeah, perhaps 1%. But it still doesn't matter. The point is: why taking the chance instead of copy-pasting a different command? That I don't understand. | |
| Apr 11 at 23:33 | comment | added | kos | No matter how many distributions updated, no matter how slim you think the chance is (to which slim chance I kinda agree), the point is that, unless you know better than those currently clearing the binary and unless you can provide compelling evidence that the binary is safe to be run that way, your security clearance is, I'm sorry, irrelevant, much as mine would be. You're speculating the binary is safe because "whoever would want to hook the binary on a call to the version dump function" but haven't we just been proven totally wrong exactly this way? | |
| Apr 11 at 23:33 | comment | added | kos | I don't understand why you're being so stubborn in defending doing something not mandatory and only (albeit with low chances) potentially dangerous while, having the malicious binay not been completely reverse engineered by top security experts yet, there's still a chance it may do things. | |
| Apr 11 at 23:32 | comment | added | kos | I red your other comments. Nobody ever questioned that your command works and that it reveals the correct version, you're derailing the conversation. The point I'm making and that you seem to be missing is: why taking the chance when you either 1. don't need it as you're on a LTS or 2. you're not on an LTS and there are alternate ways to check. | |
| Apr 11 at 22:08 | comment | added | user unknown |
… the combination of programs in an atypical way. Then there might be the small chance, that this person has sshd avaiable in combination with systemd and xz, but hadn't started them since updating. Only in this very rare circumstances, the case could be made, that running xz might trigger something, which hadn't already happened. But this case is not probable, as already pointed out, because a non trivial code change in the --version option would be suspicious. If you like to assume such a scenario, you may as well assume that strrings or or apt-cache have been compromised meanwhile.
|
|
| Apr 11 at 22:01 | comment | added | user unknown | Maybe you missed my other other comments, where I already stated, that the command HAS BEEN USED on an affected system and revealed the correct version number, which has been withdrawn by at least all popular distributions so far, in case they had delivered it via their systems. So the fat warning, you recommend, is superfluous for systems which are not affected, as you concluded yourself. On systems which have installed the backdoor, it reveals its vulnerability, which is the whole point of the action. Maybe one uses a niche Distribution, doesn't trust the upgrade process or did install … | |
| Apr 11 at 18:11 | history | answered | kos | CC BY-SA 4.0 |