The Internet Was Weeks Away From Disaster And No One Knew
Veritasium1 HN recommender · recommended in 1 month, 2026–2026
documentary · general · evergreen · 2026–2026 on HN
Veritasium tells the story of the XZ backdoor, how a patient attacker became maintainer and nearly compromised SSH on Linux systems. It also covers free software history and how encryption in SSH works.
Cited as an accessible, documentary-style account of the XZ backdoor in supply chain security discussions.
Up next
11 mo on HNBehind the Scenes of iOS Security
Black Hat
9 HN recommender · 2016–2026
11 mo on HNWhy Electronic Voting Is Still A Bad Idea
Tom Scott
11 HN recommender · 2020–2026
10 mo on HNUSENIX Security '18-Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
USENIX
10 HN recommender · 2018–2026
10 mo on HNDefcon 18 Changing threats to privacy Moxie Marlinspike Part
killab66661
6 HN recommender · 2012–2019
9 mo on HN28c3: The Science of Insecurity
28c3
9 HN recommender · 2012–2024
8 mo on HNDEF CON 25 - John Sotos - Genetic Diseases to Guide Digital Hacks of the Human Genome
DEFCONConference
11 HN recommender · 2017–2023
7 mo on HNElevator Hacking: From the Pit to the Penthouse
DeviantOllam
9 HN recommender · 2014–2026
7 mo on HNCompiling C to printable x86, to make an executable research paper
suckerpinch
8 HN recommender · 2018–2023
7 mo on HNBreak Me00 The MoVfuscator Turning mov into a soul crushing RE nightmare Christopher Domas
Adrian Crenshaw
6 HN recommender · 2017–2026
7 mo on HNBlackHat USA 2011: SSL And The Future Of Authenticity
Christiaan008
9 HN recommender · 2011–2017
7 mo on HN27C3: Adventures in analyzing Stuxnet (Bruce Dang from Microsoft)
basti0007
8 HN recommender · 2011–2024
7 mo on HNFrank Abagnale | Catch Me If You Can | Talks at Google
Talks at Google
8 HN recommender · 2018–2023
4 comments from Hacker News
Reminded me of a similar story at openSSH, wonderfully documented in a "Veritasium" episode , which was just fascinating to watch/listen. ▶ this video
Agreed. However, I often wonder if people like that are deliberately (or inadvertently) being a psyop seeking to burn out people ala how "Jia Tan" tried to become maintainer of xz [0]. [0] ▶ this video
Just to mention the original was cited in the most recent Veritasium video: "The Internet Was Weeks Away From Disaster and No One Knew" ▶ this video (at about the 9:50 mark)
Still no smoking gun, but possibly Russia. From the video ▶ this video : > A lot of the aliases, like Jia Tan, they sound like Asian names, and the published changes are all timestamped in UTC+8, Beijing time. So the signs point to China. And that's why it's probably not China. I mean, why would they make it that obvious? Every other part of the operation has been so meticulous, so cautious. > And they also worked on Chinese New Year, but not on Christmas. And over the years, there were nine changes that fall outside of the Beijing time into UTC+2, which is a time zone that includes Israel and parts of Western Russia. That's why some experts have speculated that this could be the work of APT29, a Russian-state-backed hacker group also known as Cozy Bear. But again, do we know? No, of course we don't know who it is, and we likely will never know.