Lunduke
News • Science & Tech
Make Computers Fun Again - Linux, UNIX, Alternative Operating Systems, Computer History, and Retro Computing. Also dad jokes.
Interested? Want to learn more about the community?
April 02, 2024

xz backdoor

I did a more thorough analysis and I changed my mind again. :) Specifically, I compared "Jia Tan" with myself, with the work I was doing on my FOSH computer during 2015-2019, when I worked a 9-to-5 job and worked on my computer after work; and I found ourselves largely comparable.

First, the data. For "Jia Tan", I took all the commits he authored (the field "Author" has the string "jiat" ) and for which the "AuthorDate" has the timezone UTC+0800. So I threw away a number of commits credited to "Jia Tan" because they may have been interference from Lasse Collins who may have applied the patches from "Jia" on his own machine at some weird time. To prevent them from skewing the results, I just threw them all out. For myself, I took the repo with the code and threw away all commits that are from 2020 and later. At that time either there was no work done, or else I wasn't using Git, or else I wasn't employed in a 9-to-5 job. After I left the job and again started using Git, my commits are all over the place. Literally. Not tracking any kind of a day-night cycle. xD

I then used the time of making the commit (AuthorDate) in it's own timezone. This means I'm basically testing the plausibility of "Jia Tan" being in UTC+0800, but it also means that for myself I'm automatically taking into account the daylight savings changes. This is important because this way I'm doing a better job comparing the purpoted behavior of two developers in their own lives.

Next, I counted all the commits. "Jia Tan" made the vast majority of his commits during 2023, amounting to 444 commits total, with the majority in about the span of a year and four months. I on the other hand have about three years of work I looked at and in that time I made 744 commits. You could say "Jia Tan" made about 40% more commits per year than I did.

Next, the commits were separated into commits made on weekdays and commits made on weekends. "Weekend" was counted as starting on 5 PM on a Friday and ending on 24 PM on Sunday. The weekend thus amounted to 33% of total time.

In total, I made 342 commits during workdays, amounting to 46.6% of all commits. On the other hand, "Jia Tan" made 311 commits during workdays, amounting to 70% of commits.

Next, all the commits were further divided into buckets according to the hour during which they were made. A commit made, say, starting with 8:00 PM and before 9:00 PM was counted to the bucket "20" (for 20:00, 24-hour time). Commits made before 1 AM were counted into bucket "0", commits made starting with noon and before "1 PM" were counted into bucket "12" and so on. The time "24 PM" didn't exist and was treated as "0 AM". I was actually using the 24-hour day throughout and I'm only coverting to 12-hour day for the purposes of writing this post. :)

Finally, every bucket was converted from a raw number of commits into the percentage of all commits from the developer that were made in that bucket. So a bucket "weekend, 20" now holds a percent instead of the actual number of commits. Percentage is, again, calculated as number of commits in the bucket divided by all the commits made by the developer.

I also made two separate "dot plots" which show in 2D both the day the commit was made and the moment of day the commit was made. The dot plots also differentiate between weekends and workdays. Workdays are red plusses and weekends are green x-es.

The graphs are below. First the graph of buckets then the two dot plots, first mine then "Jia Tan". The graph of buckets has been rotated to start with 6 AM so that it would be easier to view the events happening around the midnight, and how midnight doesn't itself change anything, really. :) Also, nobody had a single commit in the "6" bucket on either workdays or weekends.

As for the analysis, the difference between us is the fact "Jia Tan" has a large spike for work done between 8 PM and 9 PM, but otherwise we are mostly in line. You can see "Jia Tan" is probably one of those insufferable morning persons because on weekends he likes to commit during 10-12 AM. Some people... I on the other hand am displaying sensiblity in using weekends and I have a bump in the early afternoon, when you would expect to do some hacking. :) "Jia Tan" also has a bump in the "16" bucket, which might be explained with the notion he was working from 8 AM to 4 PM as a developer of some sort (remotely?) and then after finishing his dayjob he would do some FOSS maintenance, commit, go home, rest a little, and start working again around 8 PM. For the record, my work time was generally from 9 AM to 5 PM, a literal 9-to-5. :) I could also start working earlier, up to 8 AM, if I wanted to, and I would be expected to stay for 8 hours and then I'd be off. But I usually came to work at the last moment. :)

As for the reason why I usually came at the last moment, just look at the tail of the graph and you'll know. :) I don't remember I drove myself this hard. I thought I would be in bed by 1 AM, but apparently, actual records tell me I'd commonly stay up until 3 AM and then wake up after 8 AM. 6 hours sleep for the win! Don't do this kids, it wrecks your health. :)

Compared to me, "Jia Tan" is more sensible, not having any commits in the "workday, 3" bucket.

For my money, it seems as if "Jia Tan" wasn't doing this xz backdoor thing for a living, but as an afterwork hustle. He has plenty of commits in "workday, 16" and if you suppose those were made as part of an office job, he would presumably not have any commits after 8 hours of work. Yet 16+8=24, and he has plenty of commits in buckets 0 and 1 (which would imply a 10-hour workday). If you move his work hours forward by 1, then you get rid of bucket 0, but now have to deal with buckets 16 and 1. In addition, he made plenty of commits during the weekend. That is, realistically, unfeasible for an employee.

Share this post widely, if you please.

Interested? Want to learn more about the community?
What else you may like…
Videos
Podcasts
Posts
Articles
Linux Distro Declared "Non-Woke", Causing New Users & Interest to Skyrocket

While "Woke" Linux Distributions (like openSUSE) are struggling to survive, interest in OpenMandriva - a non-Woke Open Source project - is exploding.

00:29:15
January 19, 2025
Godot Game Engine Went Woke... And Lost $160,000 Per Year.

A few months ago, the Open Source Godot Game Engine enacted a mass "cleansing" of Non-Woke supporters. Then their monthly donations dropped by over 25%.

00:10:46
January 17, 2025
Tech Journalists Rally in Support of Racism and Sexism in Big Tech

"Save me from rich, white men," declares the Tech Journalists in response to some Big Tech firms decreasing racist DEl spending.

00:31:20
November 22, 2023
The futility of Ad-Blockers

Ads are filling the entirety of the Web -- websites, podcasts, YouTube videos, etc. -- at an increasing rate. Prices for those ad placements are plummeting. Consumers are desperate to use ad-blockers to make the web palatable. Google (and others) are desperate to break and block ad-blockers. All of which results in... more ads and lower pay for creators.

It's a fascinatingly annoying cycle. And there's only one viable way out of it.

Looking for the Podcast RSS feed or other links? Check here:
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

The futility of Ad-Blockers
November 21, 2023
openSUSE says "No Lunduke allowed!"

Those in power with openSUSE make it clear they will not allow me anywhere near anything related to the openSUSE project. Ever. For any reason.

Well, that settles that, then! Guess I won't be contributing to openSUSE! 🤣

Looking for the Podcast RSS feed or other links?
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

openSUSE says "No Lunduke allowed!"
September 13, 2023
"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

This episode is free for all to enjoy and share.

Be sure to subscribe here at Lunduke.Locals.com to get all shows & articles (including interviews with other amazing nerds).

"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044
January 13, 2025
Last 24 Hours: 55% off DRM-Free MP4s, & Discounted Lifetime Subscriptions

Holy guacamole, Batman! We are now over 80% of the way to our funding goal… for the end of February. And it’s not even half way through January! I am absolutely gobsmacked.

Want to help push us over the 100% line — and directly fund the truly independent Tech Journalism of The Lunduke Journal?

Lots of options. Big and small (and all amazingly helpful). Scroll down & choose whatever works best for you.

Lunduke Journal Discounts

For the next 24-sh hours (through Tuesday, January 14th), in addition to regular subscriptions, you can grab two limited discounts:

  1. Discounted Lifetime Subscriptions (details below)

  2. DRM-Free, MP4 Downloads for 2024 & 2025 (combined) for 55% off.

There many ways to support The Lunduke Journal. Choose the option that makes you smile. It’s all listed below.

Where to grab a Monthly or Yearly Subscription:

Lifetime Subscription Details:

  • Pay once, full subscription for life (on Locals, Substack, or both).

  • Available only through Tuesday, January 14th. Then the Lifetime Subscription option goes “back in the vault”.

  • Can be purchased via Locals, Substack, or with Bitcoin. Scroll down for steps.

Where to buy a DRM-Free, MP4 video yearly download pass:

Want to be able to download every show The Lunduke Journal releases (and watch them on whatever device you like)? Yeah. You can do that.

The Famous Lifetime Subscription via Locals

The "World Famous Lunduke Journal Lifetime Subscription" is exactly what it sounds like. Pay once and get full access to The Lunduke Journal (with all the perks of subscription on Locals). For life.

New Lifetime Subscriptions are available, for $200, from now through January 14th. Then this option goes "back into the vault".

Here's how to grab one of these coveted bad boys for yourself:

  1. Go to Lunduke.Locals.com/support.

  2. Select "Give Once".

  3. Enter "200" into the amount field.

  4. After checking out, Lunduke will toss you an email once your account is set to full lifetime status. (This usually happens within a few hours.)

The Famous Lifetime Subscription via Substack

You can also snag a Lifetime Subscription via Substack:

  1. Go to Lunduke.Substack.com/subscribe.

  2. Select the “Lifetime Subscription” option.

  3. After checking out, Lunduke will toss you an email once your account is set to full lifetime status. (This usually happens within a few hours.)

If you would like full, Lifetime access to Lunduke.Locals.com (which is included):

  1. Make a free account on Lunduke.Locals.com.

  2. Email “bryan at lunduke.com” with the email address you use on both Substack and Locals (can be different email addresses).

  3. Lunduke will toss you an email once your account is set to full lifetime status on Locals.

The Famous Lifetime Subscription (with Bitcoin discount)

And, finally, you can obtain a Lifetime Subscription via Bitcoin. Save a few bucks with this option, as Bitcoin processing has fewer fees associated with it.

  • Make sure you have a Lunduke.Locals.com account (a free account works just fine).

  • Send $190 worth of Bitcoin (or more) to the following address:

bc1qyjakve8fywm8pz2v99v57yhjj0vzr2vjze6fcq

  • Email "bryan at lunduke.com" with the following information: What time you made the transaction, how much was sent (in Bitcoin), and the email address you use (or plan to use) on Locals.com.

Nice and easy. Lots of options.

Once again, thank you. The Lunduke Journal would not be possible without your support.

You rule.

-Lunduke

Read full Article
January 12, 2025
Discounted Lifetime Subs, 55% Discount on MP4 Downloads for 2 Days

The Lunduke Journal remains 100% free from advertising… and, even more importantly, 100% free from all Big Tech influence.

And, because we never take a penny from any company, this is only possible thanks to you.

All of you amazing nerds showed tremendous support for The Lunduke Journal last month — grabbing Lifetime and standard subscriptions — meeting our necessary funding requirements for January… before January even started.

Mind. Blown.

This allows me to focus on new reporting — without needing to worry so much about funding and “business stuff” during the month. Which means more shows & more investigations. A massive win for all of us.

That also means that, this month, we don’t need to do a big “fundraiser”. Instead, we’re going to just send out this quick reminder of how absolutely critical your support is for the continued success The Lunduke Journal — the last bastion of truly independent Tech Journalism.

Seriously. Couldn’t do this without you.

Scroll down and take a look at the options. See if any jump out at you. Then give yourself a high five for making Tech Journalism that much more awesome.

Lunduke Journal Discounts

For the next 2 days (through Wednesday, January 15th), in addition to regular subscriptions, you can grab two limited discounts:

  1. Discounted Lifetime Subscriptions (details below)

  2. DRM-Free, MP4 Downloads for 2024 & 2025 (combined) for 55% off.

There many ways to support The Lunduke Journal. Choose the option that makes you smile. It’s all listed below.

Where to grab a Monthly or Yearly Subscription:

Lifetime Subscription Details:

  • Pay once, full subscription for life (on Locals, Substack, or both).

  • Available only until Wednesday, January 15th. Then the Lifetime Subscription option goes “back in the vault”.

  • Can be purchased via Locals, Substack, or with Bitcoin. Scroll down for steps.

Where to buy a DRM-Free, MP4 video yearly download pass:

Want to be able to download every show The Lunduke Journal releases (and watch them on whatever device you like)? Yeah. You can do that.

The Famous Lifetime Subscription via Locals

The "World Famous Lunduke Journal Lifetime Subscription" is exactly what it sounds like. Pay once and get full access to The Lunduke Journal (with all the perks of subscription on Locals). For life.

New Lifetime Subscriptions are available, for $200, from now through January 15th. Then this option goes "back into the vault".

Here's how to grab one of these coveted bad boys for yourself:

  1. Go to Lunduke.Locals.com/support.

  2. Select "Give Once".

  3. Enter "200" into the amount field.

  4. After checking out, Lunduke will toss you an email once your account is set to full lifetime status. (This usually happens within a few hours.)

The Famous Lifetime Subscription via Substack

You can also snag a Lifetime Subscription via Substack:

  1. Go to Lunduke.Substack.com/subscribe.

  2. Select the “Lifetime Subscription” option.

  3. After checking out, Lunduke will toss you an email once your account is set to full lifetime status. (This usually happens within a few hours.)

If you would like full, Lifetime access to Lunduke.Locals.com (which is included):

  1. Make a free account on Lunduke.Locals.com.

  2. Email “bryan at lunduke.com” with the email address you use on both Substack and Locals (can be different email addresses).

  3. Lunduke will toss you an email once your account is set to full lifetime status on Locals.

The Famous Lifetime Subscription (with Bitcoin discount)

And, finally, you can obtain a Lifetime Subscription via Bitcoin. Save a few bucks with this option, as Bitcoin processing has fewer fees associated with it.

  • Make sure you have a Lunduke.Locals.com account (a free account works just fine).

  • Send $190 worth of Bitcoin (or more) to the following address:

bc1qyjakve8fywm8pz2v99v57yhjj0vzr2vjze6fcq

  • Email "bryan at lunduke.com" with the following information: What time you made the transaction, how much was sent (in Bitcoin), and the email address you use (or plan to use) on Locals.com.

Nice and easy.

Once again, thank you. The Lunduke Journal would not be possible without your support.

You rule.

-Lunduke

Read full Article
January 09, 2025
post photo preview
The House of Lunduke BBS
Telnet: BBS.LUNDUKE.COM

The House of Lunduke BBS is a 20 node, Telnet BBS (bbs.lunduke.com) focused on the golden age of DOS BBS gaming -- including TradeWars 2002 and Legend of the Red Dragon.

 

 

The BBS is free to use, & creating an account takes only a moment.  All new users are granted 2 hours of access to all games on the system (more than enough to get in your daily turns of every one of these classic games).

Current games on the BBS:

  • TradeWars 2002 (aka TW2002)
  • Legend of the Red Dragon (aka LORD)
  • Legend of the Red Dragon 2
  • The Pit
  • Exitilus
  • DoorMUD
  • Barren Realms Elite

 

How to Connect

 

Accessing The House of Lunduke BBS is incredibly easy.  Simply point any Telnet client at "bbs.lunduke.com" on port 23 (the default Telnet port).

This means, on many systems, a simple:

telnet bbs.lunduke.com

Will, technically, work.

However, if you want to have the absolute best experience -- and see what BBSing was truly like back in the 1980s and 1990s -- you'll want to use a Telnet client capable of displaying ANSI color... specifically one tuned for BBSes.

The following Telnet clients are all recommended and work well with The House of Lunduke:

Once you have chosen your Telnet client, simply add "bbs.lunduke.com" to your address book and connect.  Or, from within some Telnet clients, you can also type "atdtbbs.lunduke.com" (no spaces).

Fun fact: "ATDT" is a command which tells an old-school modem to "tone dial this number".  The "AT" stands for "Attention", "D" stands for "Dial", and ending T stands for "Tone".  In the old days ATDT would be followed by a phone number... but, since we're connecting via Telnet, we now use a domain.

Or, if you want to get really old-school, it is possible to utilize DOSBox and an era appropriate terminal client (such as Telemate).

 

 

F.A.Q.

 

Q: What software does The House of Lunduke BBS run?

A: The core BBS software is known as Virtual Advanced (a successor to VBBS), a DOS-based BBS package that acheived some popularity during the early 1990s.  All of the games on the system (known as "Door games" in BBS terminology) also run on DOS -- and each is the most popular version (or the last version) of each.  A Telnet server handles incoming telnet connections -- which then interfaces with the DOS-based BBS software, using what is known as a FOSSIL driver.

 

Fun Fact: A FOSSIL driver is a serial interface driver -- which makes it easier to use a standard interface to multiple different communication devices (such as a type of dial-up modem or a Telnet connection).  FOSSIL stands for "Fido Opus SEAdog Standard Interface Layer".  Which is a fun name.

 

Q: What does "20 node" mean?

A: In "ye olden times", BBSes used modems and phone lines.  One person, at a time, could call a BBS on each phone line.  Each of these is a "node".  We are now living in the future -- and using Telnet instead of phone lines -- which means that, in theory, we could have a small mountain of people connecting at the same time.  However.  Since we are using 1980s and 1990s DOS software, jury-rigged to work with the modern Internet, some of those old limitations still apply.  20 nodes were chosen as that makes for an incredibly large BBS system... but not too difficult to manage.

 

Q: Why not use a more modern BBS server?

A: There are several "modern" BBS servers -- with many fancy benefits.  MysticBBS, Synchronet, and others.  The House of Lunduke BBS is not about being modern.  Or fancy.  It is about preserving a snapshot of a high-point in BBS gaming history.

Read full Article
See More
Available on mobile and TV devices
google store google store app store app store
google store google store app tv store app tv store amazon store amazon store roku store roku store
Powered by Locals