Hacker News new | ask | show | jobs
by BoomerMoment 813 days ago
Portability. A test to get the answer to "what the fuck am I running on and what does it support" is more portable and robust than thousands of "flavours" manually configured in /etc/whatamieven.conf

The author misses that the buildtime magic for the xz exploit is not in the m4 file but in an obfuscated, compressed, encrypted, binary disguised as a test file that alters the build process at multiple stages (configure and build)

A better argument can be made that the act of compiling a binary / obfuscating / minifying code instead of interpreting code directly is the fault.
2 comments
davisp 813 days ago
From the article:

That means it's totally normal to ship all kinds of really crazy looking stuff, and so when someone noticed that and decided to use that as their mechanism for extracting some badness from a so-called "test file" that was actually laden with their binary code, is it so surprising that it happened? To me, it seems inevitable.

Yeah, no. The author is well aware of how and why autotools are not awesome but also with the background of why they exist.

A better argument can be made that the act of compiling a binary / obfuscating / minifying code instead of interpreting code directly is the fault.

I can’t decide if you’ve never worked in systems software or trying to be hyperbolic. Given that it’s HN I’ll assume the best. But who do you think would do the interpreting? The priests at Delphi?

link
forrestthewoods 813 days ago
configure is a mistake. Building a project shouldn’t generate input files that are dependent on the system state. That’s what C projects from the 90s do and it’s genuinely awful.
link
matheusmoreira 812 days ago
What is the alternative? Even if you're very organized and abstract away all the stuff into neat platform-specific modules, you'll still have those system-dependent inputs in the build system. No matter what happens it will still have to pick which of those modules to include in the build and it will most likely do so via some target variable whose default value is whatever it autodetects the host system as.
link