Adam LeventhalApr 9, 2024

What an Oxide and Friends last night! @bcantrill and I were joined by the one and only @AndresFreundTec to talk about his discovery of the xz backdoor. It’s an incredible story… so great to get into the details with Andres. Definitely check it out (or on the pod tomorrow).

https://youtu.be/jg5F9UupL6I

Oxide and Friends 4/8/2024 -- Discovering the XZ Backdoor with Andres Freund

YouTube
Show threadAdam Leventhal
I was really pleased by this background image so wanted to talk about it briefly. The concept was (of course!) simple: the (in)famous xkcd graphic with the thankless Nebraskan removed https://xkcd.com/2347/
Dependency

xkcd
Apr 9, 2024 at 8:18pmWeb
Show threadAdam LeventhalApr 9, 2024
Like all lazy people in 2024, I turned to Chat GPT for help. This didn't work out well. (Have I mentioned that I'm bad at Chat GPT?)
Show threadAdam LeventhalApr 9, 2024
I should mention that we don't put a ton of time into Oxide and Friends (sorry!) so I try to bound these side-quests at least somewhat. Somewhat. I decided to find a physics simulator (like a lunatic) and SimPHY was the first one I stumbled onto that worked well enough. I roughed out the structure from the xkcd comic:
Show threadAdam LeventhalApr 9, 2024
Then removed the linchpin:
Show threadAdam LeventhalApr 9, 2024
And simulated...
Show threadAdam LeventhalApr 9, 2024
Until I got to something that was suitably calamitous:
Show threadAdam LeventhalApr 9, 2024
I threw it on the iPad that I "borrowed" from my older son and traced it in Procreate with his Apple Pencil. 100% it could have been better, but I already felt like a crazy person and wasn't sure it was going to work out
Show threadAdam LeventhalApr 9, 2024
Then I threw the lines into Photoshop, applied the bucket tool, and ... good enough!
Show threadAdam LeventhalApr 10, 2024
Check out the episode I made this for where we interview Andres Freund on his discovery of a backdoor in XZ—maintained by the metaphorical Nebraskan! https://youtu.be/jg5F9UupL6I
Oxide and Friends 4/8/2024 -- Discovering the XZ Backdoor with Andres Freund

YouTube
Show threadBrian CampbellApr 10, 2024
@ahl Wait, why is everyone referring to Andres as the Nebraskan? It was really more Lasse Collin, the sole maintainer of xz, who was an appealing target because he was sole maintainer of something the whole ecosystem depended on.
Show threadBrandon BarkerApr 17, 2024
@ahl Regarding the announcement at the end about the book club: after hearing that the audiobook wasn't available in the US, I signed up for a libro.fm account, moved to Corfe Castle, Dorset, UK (looks like a nice place), and was easily able to change my account info in libro.fm to reflect the move.
Show threadAdam LeventhalApr 18, 2024
@bbarker great tip. Thanks!
Show threadAdam LeventhalApr 10, 2024
The latest episode of Oxide and Friends where @bcantrill and I speak with @AndresFreundTec is now up on podcast platforms https://share.transistor.fm/s/e2538f7d
Oxide and Friends | Discovering the XZ Backdoor with Andres Freund

Andres Freund joined Bryan and Adam to talk about his discovery of the xz backdoor. It’s an incredible story… so great to get into the details with Andres. We started by ranting about the coverage in the New York Times… coverage that explicitly refused to dig into the details! It’s all the more...

Show threadChristoph Apr 10, 2024
@ahl @bcantrill @AndresFreundTec This was an awesome episode. Super interesting insights!
Show threadAndresFreundTecApr 10, 2024
@ahl @bcantrill I'm sorry for the audio quality. I didn't realize that was happening. I never had done a call on discord before. I now see that there's an "input sensitivity" setting, and I guess that was set wrongly. Seems pretty odd that the default doesn't work though.
Show threadDarryl RammApr 11, 2024

@ahl @bcantrill @AndresFreundTec

This was a really great podcast. With a hat-trick of goodness.

1. Super interesting details of the fantastic work by Andres Freund.

2. Dumping on the awful writing in the NYT (Roose's past clueless hyping of Crypto was terrible, thanks esp to Molly White for critiquing that)

3. The guest actually got introduced well. 🎉 🥳 🙂

Show threadMark PauleyApr 13, 2024
@ahl just listened to this and it was extremely satisfying to hear your NYT takedown. I would watch a YouTube channel of this like it was ASMR
Show threadJamie ReidApr 9, 2024
@ahl not _just_ good enough. Perfect.
Show threadAdam LeventhalApr 9, 2024
@jambulance too kind. I see only imperfections 😉
Show threadSimon ZerafaNov 30, 2024

@ahl @jambulance

Is there an animated version of this amazing artwork? 🙂🤷‍♂️

Show threadAdam LeventhalNov 30, 2024
@simonzerafa @jambulance hah: no. Just that one frame was kind of a pain
Show threadAdam LeventhalNov 30, 2024
@simonzerafa and I think I recognized your name here... https://www.grc.com/sn/SN-970-Notes.pdf
Show threadSimon ZerafaNov 30, 2024

@ahl

Guilty! 😉🤷‍♂️

Do you listen to the podcast?

Show threadAdam LeventhalNov 30, 2024
@simonzerafa nope!
Show threadSimon ZerafaNov 30, 2024

@ahl

Well your version of the XKCD artwork was well recieved 😊

Show threadPunnO)))Apr 9, 2024
@ahl What does the simulation do if you *don't* remove the Nebraskan?
Show threadAdam LeventhalApr 9, 2024
@ieure this… which seems about right
Show threadDJ SundogApr 10, 2024
@ieure @ahl shit now I want to watch the cyber-thriller The Nebraskan and that's not something I was prepared for on a Wednesday, my dudes
Show threadTim 🎮Apr 10, 2024
@ieure @ahl I've just come back to this thread a day later and this is one of the greatest scientific questions ever asked
Show threadPunnO)))Apr 11, 2024
@timixretroplays @ahl Truly unfortunate that it didn't crush him and topple over anyway.
Show threadGabriel PettierApr 10, 2024
@ahl ah, yes, Angry Birds, Open Source Supply Chain Attack edition.
Show threadPxl PhileApr 10, 2024
@ahl I am stealing this so much 😍
Show threadSchafApr 10, 2024
@ahl this should be in a museum so people in 500 yrs wonder what the heck this is
Show threadtessaraktNov 30, 2024
@schaf @ahl Could feature in a Star Trek episode, like the Discovery one with the SQL Injection...
Show threadStefan Baur 8 * 💉Nov 30, 2024
@schaf @ahl Right next to https://en.m.wikipedia.org/wiki/File:Minimalist_loss.svg?
File:Minimalist loss.svg - Wikipedia

Show threadSimon ZerafaApr 10, 2024

@ahl

I suspect this is the beginning of a new meme 🤔🤷‍♂️

Show threadbeqApr 11, 2024
@simonzerafa @ahl you know … let’s hope not.
Show threadSimon ZerafaApr 11, 2024

@f @ahl

Well the signs.and signals are not auspicious 🫤🤷‍♂️

Show threadme·ta·phil, derApr 10, 2024
@ahl *saved to disk, might come in handy more sooner than later although I hope not* 👌
Show threadMarius Gundersen - mdg 🌻Apr 10, 2024
@ahl xkcd needs to update the comic to be interactive using a js physics demo: click any dependency and it dissappears.
Show threadAdam LeventhalApr 10, 2024
@gundersen that would be incredible!
Show threadMarius Gundersen - mdg 🌻Apr 10, 2024
@ahl I'm tempted to implement this in box2d now...
Show threadAsh_CrowApr 10, 2024
@gundersen @ahl Now I kinda want a tool that does this, but you provide a git repo and it generates the pile of boxes from the dependencies of the repository, with boxes sized according to the number of contributors/maintainers for each dependency.
Show threadMarius Gundersen - mdg 🌻Apr 10, 2024
@Ash_Crow @ahl wow, that would be awesome! I wish I had the time to implement this...
Show threadHaelwenn /элвэн/ Apr 13, 2024
@gundersen @ahl Makes me wonder if someone could create a 3D game based on the dependency graph of packages.
Cyclic dependencies are going to be weird af, but packages rocketing up in the air because of those would be… quite real.
Show threadnot Evander SinqueApr 10, 2024
@ahl nice! Management will argue that it still somewhat stands, so nothing needs to be done about it. ;)
Show threadPfeffiminzteeApr 10, 2024
@ahl you forgot to label one of the middle larger blocks which are at rest as "marketed as stable product"
Show threadDr. Karoline BusseApr 10, 2024
@ahl awesome! Can I use this for my teaching and training material?
Show threadAdam LeventhalApr 10, 2024
@kbusse sure thing. Wouldn’t say no to attribution, but do what you like
Show threadSalve J. NilsenApr 10, 2024
@ahl 'Nebraska, falling' 😃
Show threadAlanApr 10, 2024
@ahl saving this for inevitable usage in a PIR.
Show threadRamon Fincken 🇺🇦Apr 10, 2024
@ahl go nebraska!
Show threadHTTP 1.1/418 TeapotApr 10, 2024
@ahl @kevinriggle Perfection.
Show threadMax R. Cerrina (he/him)Apr 10, 2024
@ahl PERFECTION
Show threadEfi (nap pet) 🦊💤Apr 10, 2024
@ahl it was bound to be
Show threaddrawnto 🟨⬜🟪⬛Apr 10, 2024
@ahl I wanna run that in box2d or another 2d engine ... but i won't.
Show threadfind you on   fediverseApr 13, 2024
@ahl Bahhahaaaa 
Show threadfind you on   fediverseApr 13, 2024

@ahl this is GOLD!! all i'll say is keep the negative space above tho (ie. dont crop) to have the best impact.

so fun, reminds me of when i did animation.

Show threadProfessor Kerstin SailerApr 13, 2024
@ahl
Beauty!