4 ms·
Folks have been ringing the alarm bell for a decade. https://www.nongnu.org/lzip/xz_inadequate.html https://www.nongnu.org/lzip/xz_inadequate.html xz is insane
by jart 1y ago
Folks have been ringing the alarm bell for a decade. https://www.nongnu.org/lzip/xz_inadequate.html https://www.nongnu.org/lzip/xz_inadequate.html xz is insane because it appears to be one of the most legitimately dangerous compression formats with the potential to gigafry your data but is exclusively used by literal turbonormies who unironically want to like "shave off a few kilobytes" and basically get oneshotted by it.
- Delk 1y agoThe question of whether the xz format is a good choice for long-term archival is entirely unrelated to backdoors or open source supply chain security.
- jart 1y agoNo they're the same. Why do you think xz was targeted? It's a giant slippery hairball.
- Delk 1y ago> Why do you think xz was targeted? Possibly for any number of reasons. A sole maintainer with a bit too little capacity to keep up the development. A central role as a dependency for crucial packages in a couple of key distros. What would be the connection between the backdoor (or indeed any supply chain security) and any design details of the xz file format? How would the backdoor have been avoided if the archive format were different?
- deleted 1y ago[deleted]
- tredre3 1y agoTurbonormies, as you say, tend to use gzip not xz. Which is sad because gzip is just as bad for archiving. A few bytes changed and your entire file is lost (in a .tar.gz it means everything is lost). Frankly, tarballs are an embarrassing relic, and it's not the turbonormies that insist they're still fit for purpose. They don't know any better, they'll do what people like you tell them to do.
- deleted 1y ago[deleted]