Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> IIRC only the "binary" files where added secretly, right? But the build script was there for people to inspect?

Yes, but it is important to note that these malicious m4 scripts were only present in the tar file. They were not checked into the git repo, which is why distros that actually built from git were not affected.

Totally agree with the problem of cryptic scripts in the build process, but unfortunately, if you maintain a project that needs to support a ton of different platforms, you don't have that much choice in your build tools. Pretty much everyone agrees that the 'autoconf soup' and its tooling (essentially m4, perl, shell, make) are all horrible from a readability perspective, and the amount of people who know these tools and can review changes is getting smaller, but switching to a more modern build system often times means dropping support for some platforms.



> Yes, but it is important to note that these malicious m4 scripts were only present in the tar file.

Looks like I got it backwards then. I thought, the test-files where the sneaky addition. Guess nobody cared for them...

> if you maintain a project that needs to support a ton of different platforms, you don't have that much choice in your build tools

Yeah, but, if possible, we could start porting those things into better frameworks instead of adding new features to this problematic Linux legacy code base. And maybe we could also retro-fix some of it with a better meta-layer, which generates the problematic code verbosely and standardized. If it can be done for JS a thousand times, it can be done for the *nix ecosystem once.

Lastly, part of it is cultural, too. Some people seem to get a kick out of reduced, arcane code, instead of expressive "prose". See, my example above... why the fuck is dot a shortcut for `source`?! Btw. I stumbled into this in Docker documentation[1]:

    echo \
      "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
      https://download.docker.com/linux/debian \
      $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
      sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
How many people would understand or catch ...

    $(. /tmp/os-release && echo "$VERSION_CODENAME") |  sudo tee ...
when `/tmp/os-release` was ...

    sudo backdoor
    VERSION_CODENAME=bookworm
... ?

Normalizing shit like this is just bad practice.

[1] https://docs.docker.com/engine/install/debian/


> why the fuck is dot a shortcut for `source`?!

The dot is the standard POSIX name for the command [0], `source` is a bash-specific alias.

[0] https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V...


Some people? They're code golfers. It's not some hidden arcane order. They actively flaunt their knowledge and abilities.


This is just Docker being Docker. If that type of thing is interesting to you, start reading the source code.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: