4 ms·
It doesn't even have a git/mercurial/CVS repo; just .tar.gz on some random website. And installation instructions are: tar -xf lzip[version].tar.gz cd lzip
by arp242 3y ago
It doesn't even have a git/mercurial/CVS repo; just .tar.gz on some random website. And installation instructions are:
tar -xf lzip[version].tar.gz
cd lzip[version] && ./configure && make check
The entire thing seems entirely the work by one person.
Yeah, this is going to massively improve things. I foresee no plausible way we can gave a repeat if we switch to this lzip thing. Absolutely watertight. We learned from past events. Problem solved.
- rurban 3y agoAbsolutely not. Extecatly this recipe brought us this desaster. The backdoor was in the released tar only, the sources were fine, because such a malicious m4 would have been detected. The compressed test bin containing the backdoor was in git, but such unobvious things do get attention.
- throwaway7356 3y ago> because such a malicious m4 would have been detected By the xz maintainer? I very much doubt that.