Top all-time · #2305
Evan Boehs
Personal blog · boehs.org · on HN as internetterpoliticsculture
Evan Boehs's personal blog at boehs.org covers politics and culture. Since 2024, 35 different Hacker News readers have linked it 64 times, most often “Everything I Know About the XZ Backdoor”. It is still writing: the last post was on 2025-10-22, and you can follow it by feed.
Hello. It's me.
Most-linked posts?
- Everything I Know About the XZ Backdoor23 people · 23 mentions · first linked 2024-03-29
- Homomorphic encryption in iOS 183 people · 3 mentions · first linked 2025-01-10
- Lies under oath: "App Store levels playing field and supports developers"2 people · 5 mentions · first linked 2024-01-27
- Making Truth Social Comply with the AGPL2 people · 3 mentions · first linked 2024-04-14
- NPM Install Everything, and the Complete and Utter Chaos That Follows2 people · 2 mentions · first linked 2024-03-15
- LLMs Are This Close to Destroying the Internet2 people · 2 mentions · first linked 2024-04-14
- Is (My) RSS Dead?2 people · 2 mentions · first linked 2024-03-30
What Hacker News says?
There's good discussion of the timeline here: https://boehs.org/node/everything-i-know-about-the-xz-backdo...
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “Backdoor in upstream xz/liblzma leading to SSH server compromise”Submitted Homomorphic encryption in iOS 18 as a story · 377 points
HN discussionOne of the primary responsibilities of a maintainer is to ensure the security of the software. If they can't keep up with the pace of development in order to ensure this for their users, then this should be made clear to the community, and a decision should be made about how to proceed. Open source maintenance is an often stressful and thankless role, but this is part of the problem that allowed this to happen. Sure…
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “Backdoor in upstream xz/liblzma leading to SSH server compromise”Submitted Everything I Know About the XZ Backdoor as a story · 195 points
HN discussionThat's the same Hans Jansen mentioned here: https://boehs.org/node/everything-i-know-about-the-xz-backdo...
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “Backdoor in upstream xz/liblzma leading to SSH server compromise”Submitted It's Been a Year and Georgia.gov Continues to Be Hacked as a story · 162 points
HN discussionI'm assuming nation states and similar actors monitor mailing lists for phrases like "I'm feeling burnt out" or "not enough bandwidth, can you open a PR?" According to the timeline here, trust was established in "only" a few years. https://boehs.org/node/everything-i-know-about-the-xz-backdo... So I imagine major actors already have other assets in at-risk open source projects, either for the source code or distro p…
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”Submitted Making Truth Social Comply with the AGPL as a story · 162 points
HN discussionExactly I don't understand the obsession with Russia Literally just a country with people like you and me. "Jia Tan" does not sound Russian https://boehs.org/node/everything-i-know-about-the-xz-backdo...
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”Submitted LLMs Are This Close to Destroying the Internet as a story · 77 points
HN discussionThis has been investigated and the conclusion is IMO clear: the dogpilling accounts were part of the operation. See the parts about Jigar Kumar in this link: https://boehs.org/node/everything-i-know-about-the-xz-backdo...
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”Submitted Bountysource Stole at Least $17,000 from Open Source Developers as a story · 67 points
HN discussionIt's mentioned in one of the first references in this article: https://boehs.org/node/everything-i-know-about-the-xz-backdo... IRC activity
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “Timeline of the xz open source attack”Submitted NPM Install Everything, and the Complete and Utter Chaos That Follows as a story · 54 points
HN discussionMy takeaways: First from the article itself: >"At this point Lasse seems to have started working even more closely with Jia Tan. Evan Boehs observes that Jigar Kumar and Dennis Ens both had nameNNN@mailhost email addresses that never appeared elsewhere on the internet, nor again in xz-devel ." That is an important observation! Takeaway: Most non-agenda driven actual people on the Internet, leave a trail -- an actual…
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “Timeline of the xz open source attack”Submitted The security model of dark web marketplaces as a story · 40 points
HN discussionI made an argument for making my local public transportation free: https://boehs.org/node/free-the-t Some of the arguments is based on similar German research, which is cited.
Comment linking /node/free-the-t
on “Germany's 49-euro ticket resulted in significant shift from road to rail”Submitted Apple Voice Dictation Writes 'Trump' When You Say 'Racist' as a story · 36 points
HN discussionFor years Apple has placed deliberately crafted limitations on 3rd party apps that put theirs at an advantage. They've done anything but treat developers fairly. If they did, maybe this legislation was unneeded, but with the way they've been acting, it feels like a long time coming. Edit: self plug: https://boehs.org/node/private-apis
Comment linking /node/private-apis
on “Apple announces ability to download apps directly from websites in EU”Submitted Homomorphic Encryption in iOS 18 as a story · 10 points
HN discussion> You can still manually apply styling using xslt Unless I'm using XSLT without knowing, you can do this with the xml-stylesheet processing instruction https://boehs.org/in/blog.xml
Comment linking /in/blog.xml
on “XSLT RIP”Submitted Apple Should Use Intelligence to Get It into Their Heads That We Don't Want This as a story · 8 points
HN discussionWithout reading into lunch specifically, I'd very much be inclined to say yes. The reason is, I spent many hours researching the fair structure of my transit agency. Fares that have, obviously, been in the news for being harming to low income citizens. What I found was that the city spent almost 1 billion on upgrading their collection systems, whereas the yearly revenue from those same systems amounted to 1/10th of…
Comment linking /node/free-the-t
on “I decided to pay off a school’s lunch debt”Submitted Garmin Connect+ and the Beginning of the End as a story · 6 points
HN discussionThis is a bad take. I don't make money off search engine traffic (beyond the occasional donated dollar), and yet I would quite rather[0] that AI doesn't visit my site. Imagine for a second a world where instead of publishing directly to your own website (home), you publish into the LLM's knowledge base. Nobody comes to you for information, they come to the LLM. Nobody cares about you, or the work you put in. Your la…
Comment linking /llms.txt
on “Kagi Assistant”Submitted Homomorphic Encryption in iOS 18 as a story · 6 points
HN discussionJia Tan's very first commit two years ago made suspicious changes to liblzma. See the timeline here: https://boehs.org/node/everything-i-know-about-the-xz-backdo...
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “The xz sshd backdoor rabbithole goes quite a bit deeper”Submitted I'm Opposed to the TikTok Ban as a story · 6 points
HN discussionThere's a lot of metadata about when/how they used git and IRC, and some preliminary analysis on same. Another surname in one of the commits. An apparent LinkedIn account. (See heading "OSINT" in https://boehs.org/node/everything-i-know-about-the-xz-backdo... .) A lot of these tracks could be intentionally manipulated by a sophisticated actor to disguise their identity, but it's not "nothing".
Comment linking /node/everything-i-know-about-the-xz-backdoor
on “The xz sshd backdoor rabbithole goes quite a bit deeper”Submitted US-East-1: All for One, One for All as a story · 5 points
HN discussion
