Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by NotPractical on Friday March 29, 2024 @03:15PM (#39867877)

> If you're not on a rolling release distro, your version is probably older.

Ironic considering security is often advertised as a feature of rolling release distros. I suppose in most instances it does provide better security, but there are some advantages to Debian's approach (stable Debian, that is).

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by javajosh on Saturday March 30, 2024 @01:15AM (#39872032)

>Ironic considering security is often advertised as a feature of rolling release distros.

Security is a feature of rolling release. But supply-chain attacks like this are the exception to the rule.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by yreg on Saturday March 30, 2024 @07:05AM (#39873704)

Isn't that what security-updates-only is for?

This particular backdoor is not shipped inside of a security patch, right?

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by leeoniya on Saturday March 30, 2024 @02:19AM (#39872318)

i mean, rolling implies rolling 0-days, too.

[ Parent | on HN ]