Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by andruby on Friday March 29, 2024 @03:35PM
(#39868098)
Hoe will you do that practically though? That’s probably thousands of commits upon which tens or hundred thousand commits from others were built. You can’t just rollback everything two years and expect it not to break or bring back older vulnerabilities that were patched in those commits.
[ Parent
| on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by kjs3 on Friday March 29, 2024 @06:33PM
(#39869746)
Likely part of what the attacker(s) are counting on. Anyone want to place odds this isn't the only thing that's going to be found?
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by umanwizard on Friday March 29, 2024 @09:54PM
(#39871115)
I’d bet you at even odds that nothing else malicious by this person is found in 1 month, and at 1:2.5 odds that nothing is found in a year.