News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by neurostimulant on Friday March 29, 2024 @06:37PM (#39869780)
Rolling back two years worth of commits made by a major contributor is going to be hell. I'm looking forward to see how they'll do this.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by joeyh on Friday March 29, 2024 @07:09PM (#39870041)
Not really. xz worked fine 2 years ago. Roll back to 5.3.1 and apply a fix for the 1 security hole that was fixed since that old version. (ZDI-CAN-16587)

Slight oversimplification, see https://bugs.debian.org/1068024 discussion.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by kelseydh on Wednesday April 03, 2024 @04:21AM (#39914822)
This seems true with so many of these core libraries. Change for the sake of change introduces attack vectors. If it ain't broke, don't fix it!
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @08:30AM (#39916583)
Yeah but people will cry "dead project" if there hasn't been a release for a week.
[ Parent | on HN ]