News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bawolff on Friday March 29, 2024 @04:12PM (#39868502)
Whether its reasonable is debatable, but that type of time frame is pretty normal for things that aren't being actively exploited.

This situation is perhaps a little different as its not an accidental bug waiting to be discovered but an intentionally placed exploit. We know that a malicious person already knows about it.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by londons_explore on Friday March 29, 2024 @05:04PM (#39868991)
If you were following Google Project Zero's policy (which many researchers do), any in-the-wild exploits would trigger an immediate reveal.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by larschdk on Friday March 29, 2024 @05:13PM (#39869089)
Detecting a security issue is one thing. Detecting a malicious payload is something completely different. The latter has intent to exploit and must be addressed immediately. The former has at least some chance of noone knowing about it.
[ Parent | on HN ]