3 ms·
Quite ironic: The most recent commit in the git repo is "Simplify SECURITY.md", committed by the same Github account which added the backdoor. https://github.c
by formerly_proven 3y ago
Quite ironic: The most recent commit in the git repo is "Simplify SECURITY.md", committed by the same Github account which added the backdoor.
https://github.com/tukaani-project/xz/commit/af071ef7702debef4f1d324616a0137a5001c14c https://github.com/tukaani-project/xz/commit/af071ef7702debe...
- rany_ 3y agoIt's not ironic, this change is really sinister IMO. They want you to waste more time after you've submitted the security report and maximize the amount of back and forth. Basically the hope is that they'd be able to pester you with requests for more info/details in order to "resolve the issue" which would give them more time to exploit their targets.