News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bombcar on Friday March 29, 2024 @02:18PM (#39867271)
> Seems innocuous, but maybe they were planning further changes.

Seems like an attempt to get 90 days of "use" of this vulnerability after discovery. If they only had checked performance before!

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by hackernudes on Friday March 29, 2024 @03:18PM (#39867916)
No, they just removed the bullet points about what to include in a report. The 90 days part was in both versions.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bombcar on Friday March 29, 2024 @03:23PM (#39867965)
True, but the "talk only to me" part was new, I think.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by hughesjj on Tuesday April 02, 2024 @05:28AM (#39903806)
They didn't add any content, it was a pure removal commit
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by meragrin_ on Friday March 29, 2024 @05:12PM (#39869081)
Yes. An incomplete report allows for dragging out "fixing" the issue longer.
[ Parent | on HN ]