4 ms·
NixOS is really irrelevant here because the xz backdoor specifically targeted RedHat and Debian. It's equally relevant to say the xz backdoor didn't affect Wind
by donnachangstein 2y ago
NixOS is really irrelevant here because the xz backdoor specifically targeted RedHat and Debian. It's equally relevant to say the xz backdoor didn't affect Windows (ironically the backdoor was ultimately found by a Microsoft employee, an oft-overlooked detail).
- sirspamalot104 2y ago[flagged]
- sirspamalot103 2y ago[dead]
- sirspamalot106 2y ago[dead]
- sirspamalot110 2y ago[dead]
- sirspamalot111 2y ago[flagged]
- attila-lendvai 2y agoa slightly improved version of NixOS (or Guix) would have automatically caught this backdoor once it reached their repos. they are relevant.
- brabel 2y agoA slightly improved version of any OS would've automatically caught it.
- attila-lendvai 2y agomechanism, or it didn't happen. and if any OS, then for windoze please!
- account42 2y agoif ( file_checksum == xz_backdoor ) { red_alert(); } There. Of course this doesn't buy you anything if the exploit is changed to target a "patched" OS but the same goes for the proposed Nix solution.
- attila-lendvai 2y agohow is that automatic if you need the checksum of the backdoor?! automatic here means that code written prior to the existence/knowledge of the xz backdoor catches not only this specific attack, but the entire class of such tarball attacks.