Discovering the xz backdoor with Andres Freund [audio](oxide.computer) |
Discovering the xz backdoor with Andres Freund [audio](oxide.computer) |
My brother, who is not in IT, sent me the article a few days ago. He was fascinated by the underlying story but frustrated with the article's tone and lack of explanation, so I'm confident this isn't just me suffering from a bout of Gell-Mann amnesia.
[1] https://www.nytimes.com/2024/04/03/technology/prevent-cybera...
> "[Andres Freund's] job involves developing a piece of open-source database software known as PostgreSQL, whose details would probably bore you to tears if I could explain them correctly, which I can’t."
And that line doesn't matter at all for the purposes of understanding the "xz" attack. To me it's pretty innocuous and self-deprecating and makes sense for the general readership the NYTimes writes for.
I don't understand what people wanted to be covered in this article? At what point would there be sufficient technical detail to suffice yet still keep the layperson interested enough to read the rest of the article?
On the other hand if you feel somehow slighted by the flippant attitude in the article, give it a rest! Why are you so sensitive? It's not like he's personally insulting you! The tech community is hardly the underdog any longer, so let's just take a joke once in a while, no? As President Eisenhower quoted[0], "Always take your job seriously, never yourself"
[0] https://www.eisenhowerlibrary.gov/sites/default/files/file/w...
Again, the job of a journalist is to simplify and explain. Think about general-audience articles on subjects you're _not_ deeply familiar with. They typically do not patronize you or tell you that the details are boring; instead they try to explain the issues at hand in the most accessible way they can. Software is no different from science, law, or medicine in having lots of arcane terminology and intricate technical detail; it is not somehow the case that those topics can be simplified and explained but that a software problem can only be understood, even in concept and imprecisely, by a special cast of techno monks. But we seem to pretend it is, because we have strangely low standards for technology journalism.
Programming is to engineering as math is to science. Namely, it's made up. Less basis in physical reality.
Same reason learning Elvish isn't as respectable as learning Spanish. One guy made it up, and it hasn't been proven by centuries of actual use.
Programming carries the same odor of "fantasy". Maybe in 300 years, when we're all living in holodecks on spaceships, it'll have a patina of authenticity. For now, we're Mr Robot and Silicon Valley
As a technical person, I did not feel patronized by the article. My non-technical wife forwarded it to me, and she also did not feel patronized by the article. If he said "you're too stupid to understand", then, yeah, that'd be patronizing.
I'll just conclude this way- when I used to sit in IDA Pro all day reverse engineering malware, I didn't expect to carry on a conversation with a perfect stranger talking at length about the intricacies of static and dynamic analysis. I have myself made similar comments about how my job involves staring at thousands of lines of assembly code and that would probably be mindnumbingly boring for them. We both have a laugh. Sometimes they do have an interest, and I can make it sound really interesting by focusing on the outcomes of the work rather than the toil and frankly mindnumbing grind; but other times, they say, yea, that sounds crazy, and we move on.
Nobody ever felt insulted- it's as they say "different strokes for different folks." I have had folks in other fields say similar things to me about how I would find the details of their work boring. A lot of times I am intrigued and hold a conversation to learn more, other times I agree and move on. At no point am I offended or feel patronized, though, because I am confident that if I truly cared I could learn more myself or ask questions.
Sorry – I'm not shouting, it's literally in all-caps on that page :^)
Here's a screenshot to show you where to click: https://i.imgur.com/MZ37jhD.png
