5 ms·
it's somehow immensely funny to me that some state probably had an entire project to land this backdoor in xz, spend literal years to make it happen. And then i
by rowanG077 2y ago
it's somehow immensely funny to me that some state probably had an entire project to land this backdoor in xz, spend literal years to make it happen. And then it was immediately detected and all effort was for nothing.
- microtonal 2y agoOr they have N other such projects in flight. The xz backdoor wasn’t that much work, just playing the long game. The person doing the xz project could easily do several other projects at the same time. A lot of issues do get undetected. E.g. the Debian OpenSSL security accident was only detected when a gazillion servers had predictable SSH keys.
- rowanG077 2y agoMost likely yes. That doesn't really impact the funny factor for me.
- sirspamalot113 2y ago[flagged]
- immibis 2y agoAFAIK Debian OpenSSL was detected when two people had the same GitHub key and since GitHub identifies people by their key it conflicted.
- Dwedit 2y agoYeah, without the latency regression, it probably would have gone undetected much longer. Using a secondary thread and spreading the CPU load over a few seconds would have made it not even register as a spike in CPU usage.
- immibis 2y agoOr do cheap ECDSA instead of expensive RSA. Even if the backdoor is hidden inside RSA decryption and the rest of the system thinks the thing being decrypted should be encrypted with RSA, you don't have to use it for the back door.
- sirspamalot111 2y ago[flagged]