3 ms·

Sure, but why go to the effort to exclude others? Did they think it would help avoid detection on systems that they didn't care to backdoor?

• thrdbndndn 3y ago
  Obviously it would help avoiding detection since the backdoor has the side effect of slowing down things. So you only target the ones you really want. And to me it's less that they don't care, more that their script probably only works or only has been tested on the ones using .rpm/.deb.
  • k8svet 3y ago
    > Obviously it would help avoiding detection since the backdoor has the side effect of slowing down things. My understanding was that this was the result of a bug? But I understand that part less than any of it, so I well could be wrong. >And to me it's less that they don't care, more that their script probably only works or only has been tested on the ones using .rpm/.deb. Now that, strikes me as more likely. Maybe they wanted to be relatively sure that they wouldn't be detected and needed to select a test matrix to test against (SELinux/landlock config across rpm/deb distros, versus across every distro.) I guess what I'm getting at is... did they have an intended set of targets and knew they were running deb/rpm, on top of any other factors?
• cozzyd 3y ago
  Because random people testing an unpackaged version will not find a problem
• Twirrim 3y ago
  I don't think it was specific effort to exclude others, they took efforts to ensure it happened at packaging time, to reduce chances of detection. So eg other xz devs didn't notice it when compiling it, and so on.