7 ms·

From https://research.swtch.com/xz-timeline https://research.swtch.com/xz-timeline : 2024-02-29: On GitHub, @teknoraver sends pull request to stop linking libl

From https://research.swtch.com/xz-timeline https://research.swtch.com/xz-timeline : 2024-02-29: On GitHub, @teknoraver sends pull request to stop linking liblzma into libsystemd. It appears that this would have defeated the attack. Kevin Beaumont speculates that knowing this was on the way may have accelerated the attacker’s schedule. @teknoraver commented on HN that the liblzma PR was one in a series of dependency slimming changes for libsystemd; there were two mentions of it in late January. I think that this is a plausible explanation for a rushed schedule and an actually justified deadline.

eichin 3y ago
(From the "history may not repeat itself but it sure does rhyme" files: Berkeley releasing a new ftpd with fixes for a bunch of buffer overruns (in Fall of 1988, when this was a New Thing) was widely suspected to be a reason the Morris Worm launched when it did, because some of the holes it used might have gotten closed too. I'm not sure if this ever got confirmed but it was part of the earliest responsible disclosure narratives...)