3 ms·
The xz backdoor was news because they went to a lot of effort to try to hide a backdoor in the source (actually a binary file in the source) and still failed.
by uecker 2y ago
The xz backdoor was news because they went to a lot of effort to try to hide a backdoor in the source (actually a binary file in the source) and still failed. In contrast, without reproducible builds it is trivial for a maintainer with upload rights (or somebody who managed to get the credentials from a maintainer) to insert a backdoor into a binary. And it is then virtually impossible to detect.
- rcxdude 2y agoWell, the xz backdoor was detected through the behaviour of the resulting binaries, not through observation of the source code tampering, so I don't think it's a great example.
- drowsspa 2y agoYeah, I would say the x backdoor succeeded summa cum laude
- uecker 2y agoFair point. It was pure luck that it was discovered. What I was referring to mainly was how much effort it took to get the backdoor installed in the first place, compared to simple uploading a compromised binary somewhere.