News for hackers. Stuff that matters.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by kapouer on Friday March 29, 2024 @05:42PM (#39869325)
Github accounts of both xz maintainers have been suspended.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by miduil on Friday March 29, 2024 @05:45PM (#39869355)
Not true, the original author wasn't suspended: https://github.com/Larhzu

https://github.com/JiaT75 was suspended for a moment, but isn't anymore?

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by boutique on Friday March 29, 2024 @05:48PM (#39869381)
Both are suspended for me. Check followers on both accounts, both have a suspended pill right next to their names.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by miduil on Friday March 29, 2024 @06:04PM (#39869490)
Ah, thanks for correcting me there - really weird that this isn't visible from the profile itself. Not even from the organization.

The following page for each other show both accounts suspended indeed.

https://github.com/Larhzu?tab=following

https://github.com/JiaT75?tab=following

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by miduil on Wednesday April 03, 2024 @10:20AM (#39917870)
Lasse's account was restored
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by fargle on Friday March 29, 2024 @07:47PM (#39870294)
github should add a badge for "inject backdoor into core open source infrastructure"
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @07:19AM (#39915981)
Hey maybe it would get bad actors to come clean trying to get that badge.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by FridgeSeal on Friday March 29, 2024 @10:13PM (#39871216)
GitHub’s UI has been getting notoriously bad for showing consistent and timely information lately, could be an issue stemming from that.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by justinclift on Saturday March 30, 2024 @12:49AM (#39871911)
Yeah. Had a weird problem last week where GitHub was serving old source code from the raw url when using curl, but showing the latest source when coming from a browser.

Super frustrating when trying to develop automation. :(

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by logicziller on Sunday March 31, 2024 @02:29AM (#39881935)
These shouldn't be suspended, and neither should their repositories. People might want to dig through the source code. It's okay if they add a warning on the repository, but suspending _everything_ is a stupid thing to do.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @07:16AM (#39915953)
Tools don't read warnings. Of course the information should not be hidden completely but intentionally breaking the download URLs makes sense.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by logicziller on Sunday April 07, 2024 @08:03PM (#39965022)
This can also be handled relatively easily. They can disable the old links and a new one can be added specifically for the disabled repository. Or even just let the repository be browsable through the interface at least.

Simply showing one giant page saying "This respository is disabled" is not helpful in any way.