Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by cesarb on Friday March 29, 2024 @04:32PM (#39868697)

> I think we should seriously consider something like a ts clearance as mandatory for work on core technologies.

Was xz/lzma a core technology when it was created? Is my tiny "constant time equality" Rust crate a core technology? Even though it's used by the BLAKE3 crate? By the way, is the BLAKE3 crate a core technology? Will it ever become a core technology?

With free software in general, things do not start a "core technology"; they become a "core technology" over time due to usage. At which point would a maintainer have to get a TS clearance? Would the equivalent of a TS clearance from my Latin America country be acceptable? And how would I obtain it? Is it even available to people outside the military and government (legit question, I never looked)?

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by zeroCalories on Friday March 29, 2024 @04:48PM (#39868823)

We probably shouldn't use your code at all, is the real answer. You can get TS, it just costs a lot of money.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by stackskipton on Friday March 29, 2024 @06:08PM (#39869514)

In United States, you cannot apply for a clearance. You must get a job that requires a clearance, then start application process and wait.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by msm_ on Friday March 29, 2024 @07:31PM (#39870206)

Who is "we"? Are you from the US by any chance? Do you mean that the US government should rewrite every piece of core architecture (including Linux, Ssh, Nginx...) from scratch? Because they are all "contaminated" and actually were created by non-americans.

If that's the case, you do you. Do you also think that all other countries should do the same, and rewrite everything from scratch for their government use (without foreign, for example American, influence)? And what about companies? Should they be forced to switch to their government's "safe" software, or can they keep using Linux and ssh? What about multi-national companies? And what even counts as a "core" software?

So yeah, I don't think it's a good idea.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by zeroCalories on Friday March 29, 2024 @08:35PM (#39870622)

We can keep it between NATO plus friends.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by AnonymousPlanet on Saturday March 30, 2024 @10:13AM (#39875094)

Wow, I can't decide which is the bigger act of sabotage to open source, your ideas or the actual backdoor.

[ Parent | on HN ]