Email or username:

Password:

Forgot your password?
scy's posts Post Back to profile
Top-level
scy

Also, PSA for people who are immediately triggered by the word "systemd", partially blaming it for the issue:

No.

Some distros patch OpenSSH to link to libsystemd to call freedesktop.org/software/syste to notify systemd about startup completion.

libsystemd then links to the backdoored lzma for other things.

But OpenSSH could've implemented the notification on its own. It's literally "send a line into a socket", only a few lines of code, even in C.

chaos.social/@smrqdt/112180465
news.ycombinator.com/item?id=3

29 March at 18:34 | Open on chaos.social
4 comments
scy

There is now a GitHub issue in the xz repository inquiring about whether this has been intentional or not.

github.com/tukaani-project/xz/

29 March at 18:37 | Open on chaos.social
scy
scy

I'm not saying that it looks like someone has specifically targeted xz and played the long game by helping out a maintainer that was overworked and suffered from mental health issues

but it does look like someone has specifically targeted xz and played the long game by helping out a maintainer that was overworked and suffered from mental health issues

mastodon.social/@glyph/1121809

29 March at 21:41 | Open on chaos.social
scy

Meanwhile, #Debian is considering rolling #xz back not only to the point before the backdoor was added, but to where the person who _wrote_ the backdoor hadn't contributed any code to xz yet.

Which means considering creating patches to fix ABI breakage such a rollback would cause.

bugs.debian.org/cgi-bin/bugrep

For all the trash talk Debian gets for being "pedantic" and slow to change: They put in the _work_ to do things _right_. I respect that.

via hachyderm.io/@joeyh/1121815129

(Edit: English is hard.)

Meanwhile, #Debian is considering rolling #xz back not only to the point before the backdoor was added, but to where the person who _wrote_ the backdoor hadn't contributed any code to xz yet.

Which means considering creating patches to fix ABI breakage such a rollback would cause.

bugs.debian.org/cgi-bin/bugrep

30 March at 1:18 | Open on chaos.social
Go Up