The abrupt change in time-of-day when commits occurred supports the theory that Jai Tan is more than one person: twitter.com/birchb0y/status/17738713818…

Yea you're right. 500ms vs 10ms on an older server. Was thrown off by this statement and thought only the perf/valgrind/gdb attachments were what really brought it to surface. > Initially starting sshd outside of systemd did not show the slowdown, despite the backdoor briefly getting invoked. This appears to be part of some countermeasures to make analysis harder. Performance was much worse but not enough to actually nudge the author into digging into it until the random ssh logins started piling up: twitter.com/AndresFreundTec/status/1774…... nitter.poast.org/AndresFreundTec/status…...