News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise.

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by k8svet on Friday March 29, 2024 @04:10PM (#39868483)
Wait, I'm on mobile. Did this partially slip by because of the ABSURD PRACTICE of publishing release.tarballs that do not 1:1 correspond with source?

Let me guess, autotools? I want to rage shit post but I guess I'll wait for confirmation first.

EDIT: YUP, AT LEAST PARTIALLY. Fucking god damn autotools.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by hypnagogic on Saturday March 30, 2024 @11:26AM (#39875730)
Been saying this the whole day now, GitHub really needs an automated diff / A/B check-up on tarballs against the actual repo, flag everything with at least a warning (+[insert additional scrutiny steps here]) when the tarball isn't matching the repo.
[ Parent | on HN ]