News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by cjbprime on Friday March 29, 2024 @05:25PM (#39869191)
OpenSSL's "notification of an upcoming critical release" is public, not private.

You do get to know that the vulnerability exists quickly, and you could choose to stop using OpenSSL altogether (among other mitigations) once that email goes out.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by sidewndr46 on Friday March 29, 2024 @09:32PM (#39871001)
if your system has already been compromised at the root level, it does not matter in the least bit
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by Thorrez on Saturday March 30, 2024 @12:40AM (#39871872)
Well if you assume everyone has already been exploited, disclosing quickly vs slowly won't prevent that.

Also, if something is being actively exploited, usually there's no or very little embargo.

[ Parent | on HN ]