3 ms·
The xz backdoor was not about safety. Nor was it really about compilation or compile time checks -- they slipped an extra object file to the linker.
by asveikau 3y ago
The xz backdoor was not about safety. Nor was it really about compilation or compile time checks -- they slipped an extra object file to the linker.
- nigeltao 3y agoYou're right that Wuffs' memory-safety isn't relevant for this attack. Still, Wuffs doesn't use autotools, and if you're pulling the library from the https://github.com/google/wuffs-mirror-release-c https://github.com/google/wuffs-mirror-release-c repository then that repo doesn't even contain any binary-data test files.