HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
tukaani-project
tukaani-project.github.io
HISTORICAL RECORD2024–2024
tukaani-project / tukaani-project.github.io · Not publicly available

tukaani-project.github.io

Discover this repository through its Hacker News conversations.

4Distinct people
6Mentions
0Explicit recommenders
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A public description has not been verified.

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by hour6 dated mentions

Observed mentions: 2024-03-29 17:33:35 UTC to 2024-03-30 00:31:28 UTC.

01232024-03-29 17:00:00 UTC to 2024-03-29 18:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsMar 29, 17:002024-03-29 18:00:00 UTC to 2024-03-29 19:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024-03-29 19:00:00 UTC to 2024-03-29 20:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-03-29 20:00:00 UTC to 2024-03-29 21:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsMar 29, 20:002024-03-29 21:00:00 UTC to 2024-03-29 22:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-03-29 22:00:00 UTC to 2024-03-29 23:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-03-29 23:00:00 UTC to 2024-03-30 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2024-03-30 00:00:00 UTC to 2024-03-30 01:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsMar 30, 00:00

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Mar 29, 17:002024-03-29 17:00:00 UTC2024-03-29 18:00:00 UTC101
Mar 29, 18:002024-03-29 18:00:00 UTC2024-03-29 19:00:00 UTC101
Mar 29, 19:002024-03-29 19:00:00 UTC2024-03-29 20:00:00 UTC000
Mar 29, 20:002024-03-29 20:00:00 UTC2024-03-29 21:00:00 UTC000
Mar 29, 21:002024-03-29 21:00:00 UTC2024-03-29 22:00:00 UTC000
Mar 29, 22:002024-03-29 22:00:00 UTC2024-03-29 23:00:00 UTC000
Mar 29, 23:002024-03-29 23:00:00 UTC2024-03-30 00:00:00 UTC303
Mar 30, 00:002024-03-30 00:00:00 UTC2024-03-30 01:00:00 UTC101

What Hacker News says

6 sources
Thank you. If you wouldn't have explained the background, I totally would've thought that this is just an innocent typo. (I still think it's like... 60% a typo? don't know) Anyhow, other people called the CCing of JiaT75 by Lasse suspicious: https://news.ycombinator.com/item?id=39867593 https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co... Someone pointed out the "mental health issues" and "some other things" https://news.ycombinator.com/item?id=39868881 https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... Lasse is of course a Nordic name, and the whole project has a finnish name and hosting https://news.ycombinator.com/item?id=39866902 If I wanted to go rogue and insert a backdoor in a project of mine, I'd probably create a new sockpuppet account and hand over management of the project to them. The above is worringly
Read the rest
compatible with this hypothesis. OTOH, JiaT75 did not reuse the existing hosting provider, but rather switched the site to github.io and uploaded there old tarballs: https://github.com/tukaani-project/tukaani-project.github.io... If JiaT75 is an old-timer in the project, wouldn't they have kept using the same hosting infra? There are also some other grim possibilities: someone forced Lasse to hand over the project (violence or blackmailing? as farfetched as that sounds)... or maybe stole Lasse devices (and identity?) and now Lasse is incapacitated? Or maybe it's just some other fellow scandinavian who pretended to be chinese and got Lasse's trust. In which case I wish Lasse all the best, and hope they'll be able to clear their name. Is the same person sockpuppeting Hans Jansen? It's amusing (but unsurprising) that they are using both german-sounding and chinese-sounding identities. That said, I don't think it's unreasonable to think that Lasse genuinely trusted JiaT75, genuinely believed that the ifunc stuff was reasonable (it probably isn't: https://news.ycombinator.com/item?id=39869538 ) and handed over the project to them. And at the end of the day, the only thing linking JiaT75 to a nordic identity is a nordic racist joke which could well be a typo. People already checked the timezone of the commits, but I wonder if anyone has already checked the time-of-day of those commits... does it actually match the working hours that a person genuinely living (and sleeping) in China would follow? (of course, that's also easy to manipulate, but maybe they could've slip up) Anyhow, I guess that security folks at Microsoft and Google (because of JiaT75 email account) are probably going to cooperate with authorities on trying to pin down the identity of JiaT75 (which might not be very useful, depending on where they live).
In Backdoor in upstream xz/liblzma leading to SSH server compromise

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.