Lunduke
News • Science & Tech
Make Computers Fun Again - Linux, UNIX, Alternative Operating Systems, Computer History, and Retro Computing. Also dad jokes.
Interested? Want to learn more about the community?
April 02, 2024

xz backdoor

I did a more thorough analysis and I changed my mind again. :) Specifically, I compared "Jia Tan" with myself, with the work I was doing on my FOSH computer during 2015-2019, when I worked a 9-to-5 job and worked on my computer after work; and I found ourselves largely comparable.

First, the data. For "Jia Tan", I took all the commits he authored (the field "Author" has the string "jiat" ) and for which the "AuthorDate" has the timezone UTC+0800. So I threw away a number of commits credited to "Jia Tan" because they may have been interference from Lasse Collins who may have applied the patches from "Jia" on his own machine at some weird time. To prevent them from skewing the results, I just threw them all out. For myself, I took the repo with the code and threw away all commits that are from 2020 and later. At that time either there was no work done, or else I wasn't using Git, or else I wasn't employed in a 9-to-5 job. After I left the job and again started using Git, my commits are all over the place. Literally. Not tracking any kind of a day-night cycle. xD

I then used the time of making the commit (AuthorDate) in it's own timezone. This means I'm basically testing the plausibility of "Jia Tan" being in UTC+0800, but it also means that for myself I'm automatically taking into account the daylight savings changes. This is important because this way I'm doing a better job comparing the purpoted behavior of two developers in their own lives.

Next, I counted all the commits. "Jia Tan" made the vast majority of his commits during 2023, amounting to 444 commits total, with the majority in about the span of a year and four months. I on the other hand have about three years of work I looked at and in that time I made 744 commits. You could say "Jia Tan" made about 40% more commits per year than I did.

Next, the commits were separated into commits made on weekdays and commits made on weekends. "Weekend" was counted as starting on 5 PM on a Friday and ending on 24 PM on Sunday. The weekend thus amounted to 33% of total time.

In total, I made 342 commits during workdays, amounting to 46.6% of all commits. On the other hand, "Jia Tan" made 311 commits during workdays, amounting to 70% of commits.

Next, all the commits were further divided into buckets according to the hour during which they were made. A commit made, say, starting with 8:00 PM and before 9:00 PM was counted to the bucket "20" (for 20:00, 24-hour time). Commits made before 1 AM were counted into bucket "0", commits made starting with noon and before "1 PM" were counted into bucket "12" and so on. The time "24 PM" didn't exist and was treated as "0 AM". I was actually using the 24-hour day throughout and I'm only coverting to 12-hour day for the purposes of writing this post. :)

Finally, every bucket was converted from a raw number of commits into the percentage of all commits from the developer that were made in that bucket. So a bucket "weekend, 20" now holds a percent instead of the actual number of commits. Percentage is, again, calculated as number of commits in the bucket divided by all the commits made by the developer.

I also made two separate "dot plots" which show in 2D both the day the commit was made and the moment of day the commit was made. The dot plots also differentiate between weekends and workdays. Workdays are red plusses and weekends are green x-es.

The graphs are below. First the graph of buckets then the two dot plots, first mine then "Jia Tan". The graph of buckets has been rotated to start with 6 AM so that it would be easier to view the events happening around the midnight, and how midnight doesn't itself change anything, really. :) Also, nobody had a single commit in the "6" bucket on either workdays or weekends.

As for the analysis, the difference between us is the fact "Jia Tan" has a large spike for work done between 8 PM and 9 PM, but otherwise we are mostly in line. You can see "Jia Tan" is probably one of those insufferable morning persons because on weekends he likes to commit during 10-12 AM. Some people... I on the other hand am displaying sensiblity in using weekends and I have a bump in the early afternoon, when you would expect to do some hacking. :) "Jia Tan" also has a bump in the "16" bucket, which might be explained with the notion he was working from 8 AM to 4 PM as a developer of some sort (remotely?) and then after finishing his dayjob he would do some FOSS maintenance, commit, go home, rest a little, and start working again around 8 PM. For the record, my work time was generally from 9 AM to 5 PM, a literal 9-to-5. :) I could also start working earlier, up to 8 AM, if I wanted to, and I would be expected to stay for 8 hours and then I'd be off. But I usually came to work at the last moment. :)

As for the reason why I usually came at the last moment, just look at the tail of the graph and you'll know. :) I don't remember I drove myself this hard. I thought I would be in bed by 1 AM, but apparently, actual records tell me I'd commonly stay up until 3 AM and then wake up after 8 AM. 6 hours sleep for the win! Don't do this kids, it wrecks your health. :)

Compared to me, "Jia Tan" is more sensible, not having any commits in the "workday, 3" bucket.

For my money, it seems as if "Jia Tan" wasn't doing this xz backdoor thing for a living, but as an afterwork hustle. He has plenty of commits in "workday, 16" and if you suppose those were made as part of an office job, he would presumably not have any commits after 8 hours of work. Yet 16+8=24, and he has plenty of commits in buckets 0 and 1 (which would imply a 10-hour workday). If you move his work hours forward by 1, then you get rid of bucket 0, but now have to deal with buckets 16 and 1. In addition, he made plenty of commits during the weekend. That is, realistically, unfeasible for an employee.

Share this post widely, if you please.

Interested? Want to learn more about the community?
What else you may like…
Videos
Podcasts
Posts
Articles
Open Source AI Definition: Not Open, Built by DEI, Funded by Big Tech

Run by an "Anti-Racist, Decolonizing" Activist, the new Open Source Definition is anything but Open.

The article:
https://lunduke.locals.com/post/5917220/open-source-ai-definition-not-open-built-by-dei-funded-by-big-tech

More from The Lunduke Journal:
https://lunduke.com/

00:18:35
GNOME bans Manjaro Core Team Member for uttering "Lunduke"

The GNOME team has censored -- and deleted the account -- of the maintainer of Manjaro Linux GNOME Edition. Why? Because he linked to a Lunduke article.

GNOME bans Manjaro Core Team Member for uttering "Lunduke":
https://lunduke.locals.com/post/5908516/gnome-bans-manjaro-core-team-member-for-uttering-lunduke

More from The Lunduke Journal:
https://lunduke.com/

00:17:16
GNOME Ousts Elected Board Member in Secret, Tells Nobody for 2 Months

Secret meetings. No transparency. Total chaos at the GNOME Foundation as they remove Sonny Piers, one of their Board Members, without telling anyone. This all happens right as the GNOME Executive Director quits, GNOME announces dire financial circumstances, and a disastrous "5 year plan" focusing on DEI.

The article:
https://lunduke.locals.com/post/5899324/gnome-ousts-elected-board-member-in-secret-and-tells-nobody-for-2-months

More from The Lunduke Journal:
https://lunduke.com/

00:37:30
November 22, 2023
The futility of Ad-Blockers

Ads are filling the entirety of the Web -- websites, podcasts, YouTube videos, etc. -- at an increasing rate. Prices for those ad placements are plummeting. Consumers are desperate to use ad-blockers to make the web palatable. Google (and others) are desperate to break and block ad-blockers. All of which results in... more ads and lower pay for creators.

It's a fascinatingly annoying cycle. And there's only one viable way out of it.

Looking for the Podcast RSS feed or other links? Check here:
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

The futility of Ad-Blockers
November 21, 2023
openSUSE says "No Lunduke allowed!"

Those in power with openSUSE make it clear they will not allow me anywhere near anything related to the openSUSE project. Ever. For any reason.

Well, that settles that, then! Guess I won't be contributing to openSUSE! 🤣

Looking for the Podcast RSS feed or other links?
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

openSUSE says "No Lunduke allowed!"
September 13, 2023
"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

This episode is free for all to enjoy and share.

Be sure to subscribe here at Lunduke.Locals.com to get all shows & articles (including interviews with other amazing nerds).

"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

Heads up:

The Lunduke Computer Operating System forum is getting some structure... and, for those of you looking to get involved, posts are starting to go up discussing specific areas available for contribution.

https://lcosforum.lunduke.com/

"source" (Linux Command) 👨‍🏫 I know it from a "User Level Red Hat" Course that I took in Community College (Tech School).

I installed Llama 3.1 8B locally on my $600 windows 11 machine (Ryzen 7 mobile processor, 8 cores, 64gig ram, integrated gpu). Not exactly a high performance genai machine.

Initial impression? Pretty nice. Quick enough - but not nearly as quick as ChatGPT.

I told it about Lunduke and OSNews and asked for a Haiku:

Truth stands strong against hate
Lunduke's voice echoes love loud
Light shines in the dark

With some more prompting we arrived at:

Bytes of love prevail
Osnews' hate crashes to zero
Lunduke's code saves

Not bad. I gave it one of my blog posts to review, and it did a solid job. Then we discussed diabetes and such. Even this 8B version, is nice.

The 70B version will probably run on my machine.

Looking forward to someone taking off the censorship. A model this good, uncensored, running locally? Game changer.

post photo preview
Editor of OSNews calls for the murder of a Conservative, Jewish Tech Journalist
Leftist Extremist OSNews says Lunduke is "Nazi" who must "die".

The Editor of OSNews.com has declared that I, Lunduke, am a member of the Nazi party -- and encourages others to murder me.

I repeat: A Tech Journalist has stated -- as a matter of fact -- that a proud Jewish man is a Nazi that must be killed.

Absolutely insane.

On Friday, July 26th, the Editor of OSNews.com (Thom Holwerda), posted the following to his Mastodon account:

"Hey linuxrocks.online, you have a nazi infestation. Considering your instance seems to use only approved registrations, this surely raises about a million red flags."

 

Source: Mastodon

 

What was the "Nazi infestation" he speaks of?  He includes a screenshot of The Lunduke Journal account to make it clear who he was refering to.

While this is already absolutely insane (no sane person would call a proud Jewish man a member of the Nazi party)... it gets far, far worse.

A few hours later, the OSNews.com Editor followed up with the following statement:

"Since the instance linuxrocks.online is openly, knowingly, and willingly hosting nazis, I'm going to block the whole instance. If you're a follower on said nazi instance, I suggest you reconsider your choice of instance.

 

No quarter for nazis. The only good nazi is a dead nazi."

 

Source: Mastodon

 

"No quarter for nazis. The only good nazi is a dead nazi."

Am I a Nazi?  Obviously not.  But, that Tech Journalist says that I am a Nazi.  And I must be killed.

Which means, according to the Editor of OSNews, "The only good [Lunduke] is a dead [Lunduke]."

Is it libel?  Without question.  Is this a clear threat of violence?  Absolutely.

He also appears to be stating that anyone who simply exists on the same server as me is, by proximity, also a Nazi.  And they must also be murdered.

Few Will Condemn This

I wish I could say this was a completely isolated incident.

The sad fact is, a number of Tech Journalists share the extreme, Leftist, disturbed, violent views of the Editor of OSNews.  They believe that many groups (including both Conservatives and Jews) are evil "Nazis" who must be murdered.

And, while many other Tech Journalists do not agree with those warped, twisted ideas... few, if any, will speak out against those calls for violence and death.

All Hope Is Not Lost

In those vile messages quoted above, the Editor of OSNews was clearly attempting to bully the administrator of a specific server -- whose only crime was allowing me to exist.

How did that server's administrator respond?  In an incredibly reasonable way:

"We do not appreciate name-calling here. Would you like to present your evidence that a user needs to be removed rather than going straight to name-calling."

 

Source: Mastodon

 

No name-calling.  Present evidence if you have a concern.

Reasonable.  Calm.  Practical.

Seeing that sort of response gave me just a little extra hope for the future of the Open Source and general computer industries.  If we can get more brave, reasonable, thoughtful people -- like that server administrator -- speaking against the hate and violence of people like the Editor of OSNews... we might just stand a chance.

(Of course, no response given -- by the OSNews Editor -- to this reasonable request.)

A Related Thought From Lunduke

Let's pause, and take a step back.  I'd like to talk, for just a moment, about politically charged discussions (like this one) within the broader Tech World... and on The Lunduke Journal specifically.

When I first started The Lunduke Journal, I focused entirely on the technical aspects of computing.  "Stay clear of politics, Lunduke," I told myself.  "Stick to the happy tech stuff!"

And, by and large, I managed to stay true to that for many years (with no more than a passing, momentary blip into politically charged topics once in a blue moon).

But, here we stand.

At a time when people are being banned from Open Source projects solely because of their political leanings (often leading to the complete destruction of those projects).  When entire Open Source organizations and concepts are being re-shaped -- into something not-at-all "Open" -- by political activists.  When Big Tech corporations are regularly discriminating against people based on the color of their skin or their sex.

And when, like we saw today, a Tech Journalist declares that Conservative Jewish Nerds (and the people who exist near them) are "Nazis" who need to be murdered.

Staying quiet on these issues is simply not an option.

Not for The Lunduke Journal.  And not for any other Tech Journalist worth a damn.

It is well past time to speak out against this insanity.  If you are a Tech Journalist (in whatever form... articles, podcasts, videos), shine a light on these stories.  Show people the damage that is being done to the world of computing by these political extremists.

The Lunduke Journal can't do this all alone.  But if I have to do it on my own... I will.

Because I love computing.  I love the history of it, the technical aspects, the future... all of it.  And computing is worth saving.

So, I will keep covering all of it.  Even if these extremists keep threatening to kill me.

Read full Article
post photo preview
Funny Programming Pictures Part XLIX
Mogwai & Michael J Fox Edition

Not all of these pictures are about programming and computers.  Some are about Mogwai and Michael J Fox.   Just felt right.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Read full Article
post photo preview
Open Source AI Definition: Not Open, Built by DEI, Funded by Big Tech
Run by an "Anti-Racist, Decolonizing" Activist, the new Open Source Definition is anything but Open

The Open Source Initiative is preparing to finalize what they call "The Open Source Aritificial Intelligence Definition" -- a set of rules which A.I. systems must adhere to in order to be considered, officially, "Open Source".

And everything about it is truly peculiar.

From the fact that it considers "No Data" to be "Open Data" (yeah, try to wrap your brain around that little nugget) to the corporate sponsorship (from corporations in the "Closed Source A.I." business)... to the "anti-racist, decolonizing" consultant they hired to put the whole thing together.

Yeah.  "Decolonizing".  The whole thing is just plain weird.

A Little Background

The Open Source Initiative's cliam to fame is that they are the steward of what is known as the "Open Source Definition" (aka "the OSD").  A set of rules which any software license must adhere to in order to be considred, officially, "Open Source".

The "OSD" began life back in 1997 as the "Debian Free Software Guidelines", written by Bruce Perens.  Later, with the help of Eric Raymond, that document morphed into the "Open Source Definition"... at which point the two men created the "Open Source Initiative" to act as a certification body for the OSD.

Fun Historical Tidbit: The Open Source Initiative likes to tell a long-debunked story about the creation of the term "Open Source" which they know is historically incorrect.  That little tidbit isn't critical to what we're talking about today... but it's just plain weird, right?

Flash forward to today, and both of the founders -- Perens and Raymond -- have been forced out or banned from the Open Source Initiative entirely.  Now the organization, free from the influence of the founders, is looking to expand into the newly exciting field of "Artificial Intelligence".

Thus: The creation of "The Open Source A.I. Definition"... or the OSAID.

The Anti-Racist Leadership

To create this new "OSAID", the Open Source Initiative hired Mer Joyce from the consulting agency known as "Do Big Good".

 

Mer Joyce: Process Facilitator for the Open Source AI Definition

 

Why, specifically, was Mer Joyce hired to lead the effort to create a brand new "Open Source" definition, specifically focused on Artificial Intelligence?

  • Was it her extensive background in Open Source?
  • Or her expertise in A.I. related topics?
  • Perhaps it was simply her many years of work in software, in general?

Nope.  It was none of those things.  Because, in fact, Mer Joyce appears to have approximately zero experience in any of those areas.

In fact, the stated reason that Mer Joyce was chosen to create this Open Source definition is, and I quote:

 

"[Mer Joyce] has worked for over a decade at the intersection of research, policy, innovation and social change."

 

Her work experience appears to be mostly focused on Leftist political activism and working on Democrat political campaigns.

As for the consulting agancy, Do Big Good, their focus appears to be equally... non-technical.  With a focus on "creating an equitable and sustainable world" and "inclusion".

 

The "Values" of "Do Big Good".

 

When "Do Big Good" talks about what skils and expertise they bring to a project, they mention things such as:

  • Center marginalized and excluded voices.
  • Embody anti-racist, feminist, and decolonizing values.
  • Practice Cultural humility.

 

How "Do Big Good" works.

 

Note: Yes.  They wrote "decolonalizing".  Which is not a real word.  We're going to give them the benefit of the doubt and assume they meant "decolonizing".  Spelling errors happen.

Now, how does "Embodying decolonizing values" help to draft a definition of Open Source Artificial Intelligence licensing?

No clue.  But, apparently, "decolonizing" and being "anti-racist" is important to the Open Source Definition and software licensing.

You'll note that the only software-related skill this "Do Big Good" company appears to have is that they can "work virtually or in-person".  In other words: They know how to use Zoom.

In fact, this consulting firm only gives three examples of client projects they've worked on.  And the other two are non-technical policy documents for the government of Washington State.

 

The other work of "Do Big Good".

 

Why this agency, and this individual, was hired to lead the work on the OSAID is beyond baffling.  Just the same, this appears to be part of a larger pattern within Open Source and Big Tech: Hiring non-technical, political activist types to lead highly technical projects.  It doesn't usually go well.

The Diverse Working Groups

Considering that the leadership hired to oversee the OSAID's creation is extremely non-technical --  and almost 100% focused on "anti-racist" and "decolonizing" activism -- it's no surprise that one of the first steps taken was to create "working groups" based entirely on skin color and gender identity.

 

"The next step was the formation of four working groups to initially analyze four different AI systems and their components. To achieve better representation, special attention was given to diversity, equity and inclusion. Over 50% of the working group participants are people of color, 30% are black, 75% were born outside the US, and 25% are women, trans or nonbinary."

 

What does having "25% of the people being Trans or nonbinary" have to do with creating a rule-set for software licensing?

Your guess is as good as mine.

But, from the very start of the OSAID's drafting, the focus was not on "creating the best Open Source AI Definition possible"... it was on, and I quote, "diversity, equity and inclusion".

The best and brightest?  Not important.  Meritocracy?  Thrown out the window.

Implement highly racist "skin color quotas" in the name of "DEI"?  You bet!  Lots of that!

"No Data" = "Open Data"

With that in mind, perhaps it is no surprise that the OSAID is turning out... rather bizarre.

Case in point: The OSAID declares that the complete absence of the data used to train an A.I. system... does, in fact, qualify as "Open".  No data... is considered... open data.

If that sounds a bit weird to you, you're not alone.

Let's back up for a moment to give a higher level understanding of the components of an A.I. system:

  1. The Source Code
  2. The Training Data
  3. The Model Parameters

If you have access to all three of those items, you can re-create an A.I. system.

Now, we already have the OSD (the Open Source Definition) which covers the source code part.  Which means the whole purpose of having the OSAID (the Open Source AI Definition) is to cover the other two components: The Training Data and the Model Parameters.

Without an exact copy of the Training Data used in an A.I. system, it becomes impossible to re-create that A.I. system.  It's simply how the current generation of A.I. works.

However, the OSAID does not require that the Training Data be made available at all.  The definition simply requires that:

 

"Sufficiently detailed information about the data used to train the system, so that a skilled person can recreate a substantially equivalent system using the same or similar data."

 

At first that sounds pretty reasonable... until you really think about what it means.

This means that an A.I. system would be considered "Open Source A.I." even if it provided zero data used to train it -- it simply must be possible for someone to use the closed, proprietary data... if they should happen to obtain it.

That's like saying "My software is open source.  But I'm not going to let you have the source code.  But, if you did get the source code -- like through espionage or something -- you'd be able to use it.  Which means it's open source.  But you can't distribute or modify that source.  Because it's mine."

Now, an argument could be made that the source code for an AI system could be open even if the data is all closed... and, therefor, it would be "Open Source" under the old OSD.  Which is absolutely true.  But, in that case, why have an "OSAID" at all?  Why not simply keep the existing OSD and focus on that?

Well... I think we have a simple answer to why this OSAID is so utterly strange...

The Corporate Sponsors

The Open Source Initiative is not a huge foundation, especially when compared to some.  But it's revenue is not insignificant.  And it's growing.

In 2023, the Open Source Initiative brought in a revenue of $786,000 -- up roughly $200,000 from the year prior.

 

Source: Open Source Initaitive 2023 Annual Report

 

And who sponsors the Open Source Initiative?

Google.  Amazon.  Meta.  Microsoft (and GitHub).  Red Hat.  And many other corporations. 

 

A Sampling of the Open Source Initiative Sponsors.

 

 

Many of these companies have some noteworthy things in common:

  • They are in the A.I. business in some way.
  • They make use of "Open Source" in their A.I. products.
  • They use "Open Source" as a promotional and public relations tool.
  • They, in one way or another, work with a closed, proprietary set of A.I. training data.
  • They have significant "Diversity, Equity, and Inclusion" efforts.

When you add that all together, this "Open Source AI Definition" begins to make a lot more sense.

It is, in short:

An effort to create a "Certification" which will declare all of their A.I. systems (no matter how closed their data is) as "Open Source"... while simultaneously being run by a DEI activist organization with a focus on racial and gender identity quotas.

It checks a whole lot of check boxes.  All at once.

What Impact Will This Have?

While many may argue that this "OSAID" is simply irrelevant -- and can be ignored by the broader "Free and Open Source Software" industry -- that misses a key impact that is worth noting.

That being: The continued corruption of both the ideas and the organizations of Open Source.

Not only has the Open Source Initiative banned their founding members (and re-written their own history)... they are now seeking to create a new "Open Source Definition" which will allow for systems consisting primarily of closed, proprietary data to be considered "Open Source".  Thus making their Big Tech financiers happy.

The meaning of the term "Open Source" is being actively modified to mean "A little open, and a lot closed".  And many of the same corproations which are funding this effort are also funding things like... The Linux Foundation.

Which means this corruption and dilution of the concept of "Open Source" is likely to spread far beyond the reaches of one, small (but growing) licensing certification foundation.

Also, apparently, decolonizing values... or something.

Read full Article
See More
Available on mobile and TV devices
google store google store app store app store
google store google store app tv store app tv store amazon store amazon store roku store roku store
Powered by Locals