5 ms·

Apparently, many. It looks like gettext may be containing a part of their attack infrastructure. https://github.com/microsoft/vcpkg/pull/37199#pullrequestrevi

Apparently, many. It looks like gettext may be containing a part of their attack infrastructure. https://github.com/microsoft/vcpkg/pull/37199#pullrequestreview-1924053615 https://github.com/microsoft/vcpkg/pull/37199#pullrequestrev... https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16d9c519b2d76f862abe4fe02d40f84e8daa712f7e08b616df3f16376c82431 https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16... https://github.com/MonicaLiu0311 https://github.com/MonicaLiu0311

collinfunk 2y ago
Are you referencing the '-unsafe' suffix in the second link? That is not something to worry about. This is from Gnulib, which is used by Gettext and other GNU projects. Using 'setlocale (0, NULL)' is not thread-safe on all platforms. Gnulib has modules to work around this, but not all projects want the extra locking. Hence the name '-unsafe'. :) See: https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg00127.html https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg001...
- everybackdoor 2y ago
  They may be right: https://git.alpinelinux.org/aports/log/main/gettext https://git.alpinelinux.org/aports/log/main/gettext Timeline matches and there is a sudden switch of maintainer. And they add dependency to xz!
  - kaathewise 2y ago
    psykose was a prolific contributor to Alpine's aports, with thousands of commits over the past few years[0]. So, I doubt They're involved. [0]: https://git.alpinelinux.org/aports/stats/?period=y&ofs=10 https://git.alpinelinux.org/aports/stats/?period=y&ofs=10
    - everybackdoor 2y ago
      JiaT75 was also a prolific contributor to xz over the past few years, so your assumptions are generally invalid at this point.
- deleted 2y ago
  [deleted]