### Issue 2058 - Tuesday 2nd April, 2024

## In Today's Issue

- Hacker infiltrated XZ Utils open source group for years to implant backdoor
- Solar Sunshot is a $1b program to make solar panels in Australia
- IEEE bans Lenna test image, SBF to spend 25 years in jail, all US fed govt agencies need a chief AI officer
- UK stamps must have a Datamatrix barcode on them to stop fakes
- Cheap Anbernic emulation console, Timezone credit, Lenovo handheld PC, Dell refurb laptop, Two Point Hospital, EV charge cable, BeyerDynamic headphones, Samsung microSD & SSD, Viofo dashcam, UniFI camera, Foxtel Now, Cygnett USB-C, Elgato Stream Deck, Apple gift cards

## The News

### Hacker infiltrated XZ Utils open source group for years to implant backdoor

XZ Utils is in practically every distribution of Linux and provides support for the xz compression format. Andres Freund, a developer at Microsoft, noticed that SSH was taking a fraction of a second longer to do its thing and discovered it was a result of changes made to XZ Utils and "took to the Open Source Security List to disclose the updates were the result of someone intentionally planting a backdoor in the compression software". That someone appears to be JiaT75, presumably a state sponsored actor who has been contributing to the XZ Utils project for many years, gained the trust of other contributors and made various changes to cover their tracks before adding a backdoor in February, which eventually made their way into various Linux distributions. The backdoor "allows someone with the right private key to hijack sshd, the executable file responsible for making SSH connections, and from there to execute malicious command". If it went undetected it would have been a disaster. It also raises questions about how the industry supports open source projects that turn into vital pieces of infrastructure and if any other projects are also in the midst of a long con social engineering attack.

⬆ Share or Discuss

### Solar Sunshot is a $1b program to make solar panels in Australia

Australia is blessed with amazing solar resources, we've got one of the highest rooftop solar panel install rates anywhere in the world per capita, most of the minerals required are in our dirt and we are one of the leading R&D centres for solar panel technology. The only thing missing is making the damn panels ourselves. That might change with the federal government's $1b investment in the Solar Sunshot program. ARENA will investigate "the entire supply chain from ingots and wafers to cells, module assembly, and related components, including solar glass, inverters, advanced deployment technology and solar innovation", with the aim of manufacturing solar panels locally - plus a little pork barrelling for the Hunter Region, "where the Prime Minister made the announcement at the site of the former coal-fired Liddell Power Station". Good to see a serious effort put in to do more manufacturing in Australia. We can't sell each other houses or rocks to China forever.

⬆ Share or Discuss

### IEEE bans Lenna test image, SBF to spend 25 years in jail, all US fed govt agencies need a chief AI officer

- The famous Lenna standard test image, used by computer graphics nerds for decades to test their image formats and other image related things, is now banned from use by the IEEE in manuscript submissions. Not only is the image off-putting to women in the field, the original model never gave consent for the image to be used this way.
- Sam Bankman-Fried received a 25 year jail sentence. 25 years in jail for taking billions of dollars of people's money via a cryptocurrency exchange called FTX and spending it risky investments via Alameda Research. When people couldn't get their money out of FTX because the Alameda investments went to shit, SBF's antics were exposed.
- The White House has mandated that all US federal agencies must have a "chief AI officer" and have to implement "minimum practices" when it comes to AI. They also "need to publicly disclose a list of AI tools they use, identify any risks associated with those technologies, and disclose how they are working to manage the risks".

⬆ Share or Discuss

## Something I Saw On The Internet

### UK stamps must have a Datamatrix barcode on them to stop fakes

I saw a story on Hacker News about people getting fined 5 quid in the UK for receiving (yes, receiving!) mail with counterfeit stamps, which is causing concern as these people got their stamps from Royal Mail as part of a program to swap your old stamps for new stamps that have QR codes on them. It's unknown if fake stamps got in the legit supply chain or Royal Mail's scanners are claiming legit stamps as fake. I didn't know the UK had stamps with QR codes on them, so I wondered what the code is for and discovered it's not a QR code, but a Datamatrix and it contains all sorts of info, including a supply chain ID (to combat rampant counterfeiting) and even a URL that if you scan it, can show videos - like Shaun the Sheep. Some bullshit about trying to get stamps to appeal to a younger generation?? That then lead me to this Guardian story from 2022 about people upset with the Datamatrix code stamps, who claim the whole point of their letter writing "was to give us a break from having to be engaged with digital content". That rabbit hole sucked up almost an hour of my life and I want to finish writing today's issue ASAP so I can get back into it.

⬆ Share or Discuss

## Bargains

- Anbernic RG35XX 3.5" Handheld Game Console - $53 from Aliexpress
- $10 free Timezone game credit for doing survey
- Lenovo Legion Go PC Gaming Handheld Z1 Extreme - $1147 at Officeworks
- Dell Latitude 7400 laptop (i5-8365U, 8GB RAM, 256GB SSD, 14" 1080p) - $248.82 from ACT's eBay store
- Two Point Hospital: JUMBO Edition for Switch - $8.24 on the Nintendo eShop
- 5 metre 22kW 32A Type 2 EV charging cable - $203.99 from Amazon
- BeyerDynamic DT 880 Semi-Open Back Dynamic Headphones - $199 from BeyerDynamic
- Samsung PRO Plus 512GB MicroSD - $41.05 from Amazon USA
- VIOFO A119 MINI-2 dashcam - $147 from Aliexpress
- Ubiquiti UniFi Protect UVC-G5-Flex PoE Camera - $230.33 from Amazon Germany
- Noctua NH-L12S Low Profile CPU Cooler - $76.09 from Newegg
- Foxtel Now "All Packs" subscription - $49/m for 12 months from Foxtel
- Cygnett PowerPlus 20w USB-C Wall Charger - $12 at Big W
- Samsung 990 Pro 4TB PCIe 4.0 M.2 SSD - $410.68 from Amazon USA
- Elgato Stream Deck MK.2 - $169 at JB Hi-Fi
- 20x Flybuys points on Apple gift cards at Coles

## Image Of The Day

Released by Microsoft, a complete guide to cinema, covering films up to 1994. With a custom content viewer and hundreds of stills, and dozens and dozens of audio clips and video clips. (mac84tv / Internet Archive)

## The End

📻 Light Rail Coyote - Sleater-Kinney

😎 The Sizzle is curated by Anthony "decryption" Agius and emailed every weekday afternoon.

💬 Checked out the paid subscriber only forum? It's a tidy little place to discuss tech with like minded Aussies.

👋 Forums not your thing? The Sizzle has a Slack group you can procrastinate in and chat with other nerds bored at work.

💳 Paid subscriber looking to manage your billing info, change email address or cancel your subscription? Visit the customer portal.

🎁 Make someone's day and buy them a 12 month gift subscription to The Sizzle.

📚 Browse The Sizzle Archive. A few issues are missing and it's not searchable, but it's better than nothing.

🫂 Friends of The Sizzle is a small group of businesses or organisations operated by Sizzle subscribers. Support your fellow Sizzler!

💔 Tired of my bullshit? Unsubscribe and I'll never speak to you again.

## Always Was, Always Will Be Aboriginal Land

The Sizzle is created on Wathaurong land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. I pay my respect to them and their cultures and to elders both past and present.