4 ms·

The backdoored library was linked to libsystemd, not systemd itself.

by himinlomax 3y ago

blkhawk 3y ago
"the car bomb was build into the spare wheel not the car itself...."
- nottorp 3y ago
  "... and although the spare wheel is included by default, the car is modular and you can always remove it yourself" [By dismantling the car completely and reassembling it, since you'd have to rebuild from source...]
  - chgs 3y ago
    Most cars no longer come with a spare wheel, certainly by default. Not sure if that’s because cars don’t get punctures any more due to the great state of the roads here in the U.K, or because people just can’t even change a wheel.
    - nottorp 3y ago
      Not in most systemd distros though. Those include all kinds of spare wheels that automatically take over your actual wheels.
    - JonChesterfield 3y ago
      It's to help meet emissions targets according to the garage I bought from. The spare wheel weighs more than not having one.
deleted 3y ago
[deleted]
inopinatus 3y ago
The dependency is attributable, in the largest part, to systemd's neoplastic aggrandizement of userland infrastructure and associated plumbing, making this a distinction without much of a difference.
- XorNot 3y ago
  "everyone should just reimplement LZMA!" What could possibly go wrong. I'm sure there's no history of compression tools having serious vulnerabilities due to implementation errors...
  - inopinatus 3y ago
    This is another furphy, because OpenSSH proper neither requires nor uses xz/lzma. It's made clear in Andres Freund's original report¹ that the libsystemd dependency dragging it along arises from distros patching openssh to support systemd notifications. The sad part is that systemd notifications are just a datagram on a socket, so using libsystemd for this is reminiscent of Joe Armstrong's banana. [1] https://seclists.org/oss-sec/2024/q1/268 https://seclists.org/oss-sec/2024/q1/268
    - LtWorf 3y ago
      As many have already pointed out, the library can also be linked to sshd via selinux.
      - inopinatus 3y ago
        I've seen that ambit claim too, but I'm not even sure what distro(s) it is referring to since I'm unable to confirm it on any host where I have ldd casually to hand. Ref however https://seclists.org/oss-sec/2024/q1/356 https://seclists.org/oss-sec/2024/q1/356
        deleted 3y ago
        [deleted]

The backdoored library was linked to libsystemd, not systemd itself.

blkhawk 3y ago

"the car bomb was build into the spare wheel not the car itself...."

nottorp 3y ago
"... and although the spare wheel is included by default, the car is modular and you can always remove it yourself" [By dismantling the car completely and reassembling it, since you'd have to rebuild from source...]
- chgs 3y ago
  Most cars no longer come with a spare wheel, certainly by default. Not sure if that’s because cars don’t get punctures any more due to the great state of the roads here in the U.K, or because people just can’t even change a wheel.
  - nottorp 3y ago
    Not in most systemd distros though. Those include all kinds of spare wheels that automatically take over your actual wheels.
  - JonChesterfield 3y ago
    It's to help meet emissions targets according to the garage I bought from. The spare wheel weighs more than not having one.

deleted 3y ago

[deleted]

inopinatus 3y ago

The dependency is attributable, in the largest part, to systemd's neoplastic aggrandizement of userland infrastructure and associated plumbing, making this a distinction without much of a difference.

XorNot 3y ago
"everyone should just reimplement LZMA!" What could possibly go wrong. I'm sure there's no history of compression tools having serious vulnerabilities due to implementation errors...
- inopinatus 3y ago
  This is another furphy, because OpenSSH proper neither requires nor uses xz/lzma. It's made clear in Andres Freund's original report¹ that the libsystemd dependency dragging it along arises from distros patching openssh to support systemd notifications. The sad part is that systemd notifications are just a datagram on a socket, so using libsystemd for this is reminiscent of Joe Armstrong's banana. [1] https://seclists.org/oss-sec/2024/q1/268 https://seclists.org/oss-sec/2024/q1/268
  - LtWorf 3y ago
    As many have already pointed out, the library can also be linked to sshd via selinux.
    - inopinatus 3y ago
      I've seen that ambit claim too, but I'm not even sure what distro(s) it is referring to since I'm unable to confirm it on any host where I have ldd casually to hand. Ref however https://seclists.org/oss-sec/2024/q1/356 https://seclists.org/oss-sec/2024/q1/356
      - deleted 3y ago
        [deleted]