logoalt Hacker News

Y_Y11/08/20241 replyview on HN

I'd be happy to, world you like to offer a suggestion?


Replies

saagarjha11/09/2024

As long as I don't see you joining the usual "duh this is a government backdoor" crowd next time any bug comes up, sure.

This blog post describes a class of vulnerabilities. That's why there are ten of them. A well-resourced adversary with the capability to influence software development would want their backdoor to be small and difficult to discover. In many cases they would like guarantees that they are the only entity to be able to abuse such a vulnerability. While one can argue that these bugs were difficult to find–they were only fixed now–they really aren't very good backdoor bugs. Why leave dozens of holes all over the place when you only need a few? It's much more likely that this is just a failure case that someone failed to consider.