• 0 Posts
  • 48 Comments
Joined 1 year ago
cake
Cake day: June 27th, 2023

help-circle



  • It’s intentional.

    Obviously, Google makes money showing ads during search. But they have finally bit the bullet and starting tarpitting users in search in order to show more ads.

    A quick, useful, and accurate search means that you’re on their site for the least amount of time, perhaps mere seconds. That’s not what’s best for revenue growth.

    PS: Go try Kagi and be reminded what good clean search results look like. I use it because my time has value. It’s very good.














  • The malicious code was written and debugged at their convenience and saved as an object module linker file that had been stripped of debugger symbols (this is one of its features that made Fruend suspicious enough to keep digging when he profiled his backdoored ssh looking for that 500ms delay: there were no symbols to attribute the cpu cycles to).

    It was then further obfuscated by being chopped up and placed into a pure binary file that was ostensibly included in the tarballs for the xz library build process to use as a test case file during its build process. The file was supposedly an example of a bad compressed file.

    This “test” file was placed in the .gitignore seen in the repo so the file’s abscense on github was explained. Being included as a binary test file only in the tarballs means that the malicious code isn’t on github in any form. Its nowhere to be seen until you get the tarball.

    The build process then creates some highly obfuscated bash scripts on the fly during compilation that check for the existence of the files (since they won’t be there if you’re building from github). If they’re there, the scripts reassemble the object module, basically replacing the code that you would see in the repo.

    Thats a simplified version of why there’s no code to see, and that’s just one aspect of this thing. It’s sneaky.



  • Embedded systems developer here. If you’re programming on ARM or one of the other big microcontrollers there aren’t many well supported options. ARM’s official Keil compiler and libraries are C and C++ and I see no official movement to change that.

    They have literally decades in building those tools.

    Microsoft’s multithreaded OS ThreadX is C code. They just bought it for a large undisclosed amount in 2018. It ain’t going anywhere soon.

    AWS’s FreeRTOS is C. Not going anywhere.

    Embedded development toolchains are very slow to change.