3 ms·
The point is that (even) the systemd maintainers do not vet their dependencies. As an attack vector, it is the (second?) highest level, yet they did not assume
by tgv 3y ago
The point is that (even) the systemd maintainers do not vet their dependencies. As an attack vector, it is the (second?) highest level, yet they did not assume the responsibility. Everybody silently assumed they did, hence the shock.
> Claims that systemd has bad security have to explain why it was already implementing practices ...
No, they don't. It doesn't take away the fact that they did not check xz, and probably only few of their other dependencies.
- throwaway7356 3y ago> It doesn't take away the fact that they did not check xz, and probably only few of their other dependencies. Xz is also used by Debian's package manager (both dpkg and apt). Or tar. Or the Linux kernel. Or... It already was a system library on Linux systems before systemd started using it as well. Your post reads like you have no real idea what Xz is and how it is used. Btw, do you think the Linux kernel developers are also clueless for using Xz?
- mike_hearn 3y agoNobody was silently assuming the systemd maintainers were reviewing the source tarballs of every dependency for obfuscated back doors.
- tgv 3y agoThat would be irresponsible and strengthen the case against run0 as a replacement. And let's be honest this time: the argumentation is that it's there to replace sudo.