News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by jnxx on Saturday March 30, 2024 @07:33AM (#39873860)
Yes, I think if a project has backdoors and its old maintainers are unable to review them, I am more critical than with normal projects. As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning.

And this is in part because I can not even tell for sure that he even exists. If I had met him a few times in a bar, I would be more inclined to believe he is not involved.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by saagarjha on Saturday March 30, 2024 @08:38AM (#39874265)
> As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning.

Uh, because it's a compression library?

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by ljahier on Saturday March 30, 2024 @03:20PM (#39877762)
From the project readme: > XZ Utils provide a general-purpose data-compression library plus 21 command-line tools.

https://git.tukaani.org/?p=xz.git;a=blob;f=README;h=ac812ff1...

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by UncleEntity on Saturday March 30, 2024 @09:38AM (#39874756)
I'm inclined to believe that whatever state actor was involved sent a memo to their sockpuppets to do whatever they can to deflect blame away.

See what I did there?

[ Parent | on HN ]