Top all-time · #7994
Rhea's Substack
Personal blog · rheaeve.substack.comsecurityculture
Rhea's Substack is a personal blog at rheaeve.substack.com about security and culture. Since 2024, 9 different Hacker News readers have linked it 9 times, most often “XZ Backdoor: Times, damned times, and scams”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers link this Substack for a timezone-based analysis of the xz-utils backdoor author 'Jia Tan', arguing the work hours point to UTC+2/+3, which covers Eastern Europe and Israel.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Whatever I am interested in. Launched 3 years ago.
Most-linked posts?
- XZ Backdoor: Times, damned times, and scams9 people · 9 mentions · first linked 2024-03-30
What Hacker News says?
Made a more detailed write-up on this: https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
Comment linking /p/xz-backdoor-times-damned-times-and
on “Backdoor in upstream xz/liblzma leading to SSH server compromise”Submitted XZ Backdoor: Times, damned times, and scams as a story · 277 points
HN discussionAnother analysis locates Jia in Eastern Europe: https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... But I would like to see analysis of timestamp of GitHub events (like PRs and comments timestamps) which are harder to fake.
Comment linking /p/xz-backdoor-times-damned-times-and
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”> Virginia or Maryland Eastern Europe, suggest the timestamp / holiday analysts. https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
Comment linking /p/xz-backdoor-times-damned-times-and
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”> However, I believe that he is actually from somewhere in the UTC+02 (winter)/UTC+03 (DST) timezone, which includes Eastern Europe (EET), but also Israel (IST) https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
Comment linking /p/xz-backdoor-times-damned-times-and
on “The xz sshd backdoor rabbithole goes quite a bit deeper”Based on working hours Israeli is likely https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... There are other countries on the same time zone, but only Israel has history of using and selling hacks of this level.
Comment linking /p/xz-backdoor-times-damned-times-and
on “XZ backdoor story – Initial analysis”> It’s most likely our actor just mashed plausible-sounding Chinese names together. Also from that writeup. It also links to https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... which suggests the actual TZ of 'Jia Tan' to be UTC+02/03
Comment linking /p/xz-backdoor-times-damned-times-and
on “Debian on xz-utils: revert to version that does not contain changes by bad actor”This analysis strongly suggests an Eastern European locale masquerading (with occasional oversights) as Chinese: https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
Comment linking /p/xz-backdoor-times-damned-times-and
on “XZ backdoor killswitch”at least on a surface-level analysis, the work was done in China's timezone[0] of course, you can get computers to say all sorts of things about what the time is where they're geographically located, but it's not nothing . i do find it strange that there hasn't been much discussion about what was in the object file, but maybe that just takes time. https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
Comment linking /p/xz-backdoor-times-damned-times-and
on “The Mystery of 'Jia Tan,' the XZ Backdoor Mastermind”
