4 ms·
Assuming this would be smart to do. But xz is a very good target. It seems a lot of care went into selecting it. Consider: * It is extremely critical. Used
by hyperman1 2y ago
Assuming this would be smart to do. But xz is a very good target. It seems a lot of care went into selecting it. Consider:
* It is extremely critical. Used at multiple places in the boot process, with root or kernel mode
* Nevertheless an unnoticeable dependency. Nobody thougt about its security implications
* Stable and trustworthy for years (decades?)
* Managed mostly by 1 person
* That person was more than average vulnerable for pressure, but not in a very visible way.
- vasco 2y agoI'm not saying it was a bad target. It was a perfect target. How many more would fullfil these criteria? Those would be the type of repositories I'd go and investigate. For there to be another repository affected by the same attack you don't even need to think this specific attacker did it twice. You can just consider that multiple attackers had the same idea. I think it's way more likely that there's more repositories affected by the same type of attack than not. I'd go as far as saying this is an issue of national / global security and there's space for an agency like the IMF but for software security that would be funded by all the countries of the world to bring more resources and assuredness to this type of dependencies. Because even if this attacker didn't do more than N=1 and other attackers didn't have the idea before, they surely have it now.
- dolmen 2y agoAbout "there's space for an agency like the IMF but for software security" See Tim Bray's proposal about "OSQI": https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI
- geertj 2y agoI would add to that list: * Has random binary test files in its repo, ideal for hiding exploit payloads.