Daily Tech News 31 March 2024

• A little more background on that security disaster that almost was. (Substack)
  
  It looks like it started with "social engineering" - a confidence scam - two years ago, with one person attacking the maintainer of the xz utility and another one offering to help, and then actually helping. That warped over time into slipping more and more suspect code into the package, until they got caught.
  
  It's a bit of an odd one because it took a lot of care and planning but was guaranteed to get caught and removed if it ever went mainstream. So it's not a targeted attack on particular groups, and not subtle enough to pass unnoticed long-term.
  
  If you infect one server you're likely to get away with it, but if you infect every server in the world, there are literally hundreds of honeypot servers set up by security researchers specifically to detect weird stuff like this.
  
  Purely speculation but I'm wondering if this was North Korea rather than China or Russia. It looks like the kind of miscalculation they would make.
  
  

• Software needs to be more expensive. (Glyph)
  
  There's a well-known XKCD cartoon illustrating that the modern world is utterly dependent on some random bit of code maintained by one guy in Nebraska since 2003.
  
  Not specifically true, but true in general; we nearly had a global disaster with a small but useful library called xz because the maintainer wasn't getting paid anything despite the code being used on hundreds of millions of computers. (If it's included in iOS or Android, which it probably is, billions.)
  
  The solution proposed here is to make it easy to pay these people.
  
  
  
• Meanwhile AT&T is resetting customer passcodes after millions of customers' account details were leaked... In 2019. (Tech Crunch)
  
  Or possibly earlier. AT&T doesn't know or isn't saying. But yeah, the data has been out there for five years and they're responding now.
  
  
  
• The world needs more gadgets like this (checks notes) overpriced underwhelming 27" 1080p monitor in a briefcase. (The Verge)
  
  The world needs fewer websites like The Verge. If that leaves me with nobody to mock, so be it.
  
  
  
• Banning TikTok could harm blah blah blah. (Tech Crunch)
  
  Don't care, didn't ask.

posted by Pixy Misa at 04:00 AM

| Access Comments