News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by o11c on Friday March 29, 2024 @03:01PM (#39867723)
Honestly, the Gentoo-style global blacklist (package.mask) to force a downgrade is probably a better approach for cases like this. Epochs only make sense if your upstream is insane and does not follow a consistent numbering system.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @09:10AM (#39917003)
Gentoo also considers the repository (+overlays) to be the entire set of possible versions so simply removing the bad version will cause a downgrade, unlike debian and RPM systems where installing packages outside a repository is supported.
[ Parent | on HN ]