3 ms·
Right, because that never goes wrong.[0,1] [0]: https://news.ycombinator.com/item?id=42351722 https://news.ycombinator.com/item?id=42351722 [1]: https://tukaa
by Nullabillity 2y ago
Right, because that never goes wrong.[0,1]
[0]: https://news.ycombinator.com/item?id=42351722 https://news.ycombinator.com/item?id=42351722
[1]: https://tukaani.org/xz-backdoor/ https://tukaani.org/xz-backdoor/
- goku12 2y agoThe xz example does not support your case. Not only was every downstream build infected until it was discovered, it also needed a distro-specific modification (to openssh in Debian and Fedora, IIRC) to work at all.
- Nullabillity 2y agoThe xz backdoor relied on a discrepancy between the development repository and the released (source) artifact. While skipping the released tarballs wouldn't have prevented the problem entirely, it would have made it much harder to hide.