4 ms·

So I'm trying to build ffmpeg via vcpkg today, and it turned out multiple of its dependencies are transitively depending on liblzma, but the downloading of libl

So I'm trying to build ffmpeg via vcpkg today, and it turned out multiple of its dependencies are transitively depending on liblzma, but the downloading of liblzma source has been disabled by GitHub in light of the recent xz backdoor.

reacweb 3y ago
Blocking downloads of liblzma seems to me to be an ill-advised decision. Now that the mechanism is known, the dangers are limited, but the educational value of being able to study what has been done is real.
- MrSkyNet 3y ago
  It just takes time to act/react. A week or so is not a lot of time.
- actionfromafar 3y ago
  Who knows what automated systems could pull code and integrate it into builds, otherwise.
- dspillett 3y ago
  While the dangers are limited, they certainly aren't zero. Even if the original attacker(s) have entirely gone to ground others may be scanning for hosts that managed to got compromised by following the bleeding edge and more could get compromised of downloads from primary sources are kept open. Keeping the affected code visible somewhere could be useful for research purposes, but you don't want it where people or automations might unwittingly use it. If the official sources where the only place this could be found then it might be reasonable to expect them to put up a side copy for this reason, but given how many forks and other copies there will be out there I don't think this is necessary and they are better off working on removing known compromises (and attempting to verify there are no others that were slipped in) to return things to a good state.
- axus 3y ago
  Maybe someone needs a year to audit the history and find all the other backdoors. Who's going to work on it for a year for free or without being in on it, I don't know.
mttpgn 3y ago
Internet Archive to the rescue! It's still possible to download the liblzma source code from the Internet Archive's Github snapshot of the 5.4.6 stable release: https://web.archive.org/web/20240329182145/https://github.com/tukaani-project/xz/releases/tag/v5.4.6 https://web.archive.org/web/20240329182145/https://github.co...
- Gormo 3y ago
  Lasse Collin pulled everything back to a standalone git repo, with all of the compromised code removed: https://git.tukaani.org/ https://git.tukaani.org/, which is now, I presume, the official distribution source for XZ.
ysofunny 3y ago
I worry that this is just the begining right now I'm sure it's a temporary measure, to limit the downloading of sources. but I really worry that later this will become normalized first, after every exposed hack withrdraw source availability for a little bit aftewards, just while 'they' check for other attacks or whatever later on, it'll take longer and longer to put the source back up. but let's hope this is merely my overactive paranoia and everything will be fine open source is still ok.
- Latty 3y ago
  The obvious solution seems to be adding an extra hurdle, where it warns you the source may be compromised, so you can still get it, but aren't going to just grab it without knowing something happened. There is value in making sure (potentially) compromised code doesn't just get used normally, but I agree that shouldn't mean totally blocking access to it in most cases.
- Gormo 3y ago
  GitHub is not the only place to host a git repo. After the fiasco, Lasse Collin reestablished a standalone repo at https://git.tukaani.org/ https://git.tukaani.org/.

reacweb 3y ago

Blocking downloads of liblzma seems to me to be an ill-advised decision. Now that the mechanism is known, the dangers are limited, but the educational value of being able to study what has been done is real.

MrSkyNet 3y ago
It just takes time to act/react. A week or so is not a lot of time.
actionfromafar 3y ago
Who knows what automated systems could pull code and integrate it into builds, otherwise.
dspillett 3y ago
While the dangers are limited, they certainly aren't zero. Even if the original attacker(s) have entirely gone to ground others may be scanning for hosts that managed to got compromised by following the bleeding edge and more could get compromised of downloads from primary sources are kept open. Keeping the affected code visible somewhere could be useful for research purposes, but you don't want it where people or automations might unwittingly use it. If the official sources where the only place this could be found then it might be reasonable to expect them to put up a side copy for this reason, but given how many forks and other copies there will be out there I don't think this is necessary and they are better off working on removing known compromises (and attempting to verify there are no others that were slipped in) to return things to a good state.
axus 3y ago
Maybe someone needs a year to audit the history and find all the other backdoors. Who's going to work on it for a year for free or without being in on it, I don't know.

mttpgn 3y ago

Internet Archive to the rescue! It's still possible to download the liblzma source code from the Internet Archive's Github snapshot of the 5.4.6 stable release: https://web.archive.org/web/20240329182145/https://github.com/tukaani-project/xz/releases/tag/v5.4.6 https://web.archive.org/web/20240329182145/https://github.co...

Gormo 3y ago
Lasse Collin pulled everything back to a standalone git repo, with all of the compromised code removed: https://git.tukaani.org/ https://git.tukaani.org/, which is now, I presume, the official distribution source for XZ.

ysofunny 3y ago

I worry that this is just the begining right now I'm sure it's a temporary measure, to limit the downloading of sources. but I really worry that later this will become normalized first, after every exposed hack withrdraw source availability for a little bit aftewards, just while 'they' check for other attacks or whatever later on, it'll take longer and longer to put the source back up. but let's hope this is merely my overactive paranoia and everything will be fine open source is still ok.

Latty 3y ago
The obvious solution seems to be adding an extra hurdle, where it warns you the source may be compromised, so you can still get it, but aren't going to just grab it without knowing something happened. There is value in making sure (potentially) compromised code doesn't just get used normally, but I agree that shouldn't mean totally blocking access to it in most cases.
Gormo 3y ago
GitHub is not the only place to host a git repo. After the fiasco, Lasse Collin reestablished a standalone repo at https://git.tukaani.org/ https://git.tukaani.org/.