4 ms·

Imagine a more competent backdoor attempt on xz(1)—one that wouldn't have been noticed this quickly. xz is everywhere. They could pull off a "reflections on tru

Imagine a more competent backdoor attempt on xz(1)—one that wouldn't have been noticed this quickly. xz is everywhere. They could pull off a "reflections on trusting trust": an xz which selectively modifies a tiny subset of the files it sees, like .tar.xz software tarballs underlying certain build processes. Not source code tarballs (someone might notice)—tarballs distributing pre-compiled binaries. edit to add: Arch Linux' entire package system used to run on .tar.xz binaries (they switched to Zstd a few years ago [0]). [0] https://news.ycombinator.com/item?id=19478171 https://news.ycombinator.com/item?id=19478171 ("Arch Linux propose changing compression method from xz to zstd (archlinux.org)")

nolist_policy 3y ago
deb packages are xz compressed...
- 1oooqooq 3y ago
  my freaking kernels/initrd are xz or zstd compressed!
- nolist_policy 3y ago
  ... and Debian is very serious about it: https://fulda.social/@Ganneff/112184975950858403 https://fulda.social/@Ganneff/112184975950858403
joeyh 3y ago
A backdoored xz could also run payloads hidden inside other xz files, allowing targeted attacks.
Phenylacetyl 3y ago
The same authors have also contributed to Zstd
- joeyh 3y ago
  details please? I do not see any such contributions to https://github.com/facebook/zstd https://github.com/facebook/zstd
  - delfinom 3y ago
    They are probably getting confused. Jia had a zstd fork on github, but when things kicked off, it appears they may have sanitized the fork.
deleted 3y ago
[deleted]