Also: "OpenSSH was patched so that it could notify systemd when it was ready to accept connections, using the libsystemd library, which in turn had a dependenc

Also: "OpenSSH was patched so that it could notify systemd when it was ready to accept connections, using the libsystemd library, which in turn had a dependency on the liblzma library that was compromised." I still remember the Debian OpenSSL patch fiasco. This one has a different angle: Why would you link a security sensitive application against a God library (word play on God object). DJB avoided much of libc in his software so it would not depend on libc bugs. Of course his software never received much interest because people only want to modify the software of others until it is as buggy as their own.