3 ms·

> And where are those mystery meat binaries supposed to come from? the vendor

• Nullabillity 2y ago
  Right, because that never goes wrong.[0,1] [0]: https://news.ycombinator.com/item?id=42351722 https://news.ycombinator.com/item?id=42351722 [1]: https://tukaani.org/xz-backdoor/ https://tukaani.org/xz-backdoor/
  • goku12 2y ago
    The xz example does not support your case. Not only was every downstream build infected until it was discovered, it also needed a distro-specific modification (to openssh in Debian and Fedora, IIRC) to work at all.
    • Nullabillity 2y ago
      The xz backdoor relied on a discrepancy between the development repository and the released (source) artifact. While skipping the released tarballs wouldn't have prevented the problem entirely, it would have made it much harder to hide.