3 ms·
What clickbait. I don't see anything actually "questionable" here, other than someone trying to ride on the xz hype train.
by userbinator 3y ago
What clickbait. I don't see anything actually "questionable" here, other than someone trying to ride on the xz hype train.
- Ajedi32 3y agoNot "questionable" in the sense that it might be malicious; the author acknowledges the changes are benign. But it's still questionable that the tarball made available to distros differs significantly from what's in the tagged release in git and nobody noticed that until now. As the xz incident has demonstrated, there are plenty of good security related reasons why that shouldn't be possible.