TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Xz Backdoor and Autotools Insanity

19 点作者 netol大约 1 年前

3 条评论

bell-cot大约 1 年前
I often feel that the underlying cause of problems like this is that programming is dominated by male primates.<p>If your code is short, obvious, and working - then you are an expendable nobody.<p>If your code is 10M lines of incomprehensible shit - then you are an irreplaceable demigod.<p>Doesn&#x27;t matter if both programmers&#x27; code has the exact same functionality.
评论 #39949683 未加载
SAI_Peregrinus大约 1 年前
I&#x27;d say the backdoor <i>could</i> have been hidden in another build system, even Makefiles. But it would have been much more difficult to hide.
评论 #39949664 未加载
Rochus大约 1 年前
&gt; <i>GNU Autotools is too complicated, unnecessary, and stupid ... m4 is horrible ... Nobody has the time to review the mess these tools generate</i><p>These tools are generally much too complex. I don&#x27;t think that e.g. CMake builds are easier to understand and analyze. From a certain size it&#x27;s almost impossible to fully understand and check such a system.<p>One could argue that this is the case with any type of system. This is true, but you have to bear in mind that important findings and principles of software engineering from the last fifty years seem to have passed by without a trace, especially when it comes to build systems. For example, most of these systems still use dynamically typed scripting languages to specify the build, even though these are increasingly being replaced by better languages due to their well-known disadvantages, e.g. languages that are accessible to a static check at compile time using suitable tools, or that do not leave the discovery of errors and backdoors to chance discovery at runtime.<p>Autotools, CMake, Qmake and even newer developments such as Meson or GN suffer from the same problems.<p>&gt; <i>There’s better build systems like CMake or meson (at least that’s what I’m told), but in fact plain Makefiles are superior.</i><p>There is no reason for this assumption. Non of these tools supports e.g. static analysis.
评论 #39956286 未加载
评论 #39953390 未加载