News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by raggi on Saturday March 30, 2024 @06:26PM (#39879282)
Think whatever you shall about systemd of course, but please stop with the blind belief mud slinging:

  - systemd didn't create the patch to include libsystemd, distros did
  - current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though
  - you can implement notify in standalone code in about the same effort as it takes to use the dependency, there wasn't really a good reason for distro's to be adding this dependency to such a critical binary. systemd documents the protocol independently to make this easy. distros having sketchy patches to sshd has a long history, remember the debian weak key fiasco?
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by Denvercoder9 on Saturday March 30, 2024 @06:43PM (#39879405)
> - current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though

The affected distros aren't behind on systemd updates, the change to systemd you describe has been merged but not yet released.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by raggi on Saturday March 30, 2024 @06:48PM (#39879439)
Ah, thank you for the correction!
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by x0x0 on Tuesday April 02, 2024 @12:13AM (#39902316)
Maybe you should reconsider your "blind belief mud slinging" eh?

Be better.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by everybackdoor on Saturday March 30, 2024 @07:59PM (#39879888)
This message and others like it feel like a concerted effort at damage control around systemd.

Essentially, the optics here are that an intelligence agency created systemd to be used as a secret garden, and then manufactured community support for it using social engineering (”you’re too stupid/old/bitter to understand the complex marvel we’ve created”) and now we’re all living in la-la land when it comes to computer security.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by rcxdude on Saturday March 30, 2024 @08:36PM (#39880166)
This is full conspiracy mode thinking.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by webmaven on Sunday March 31, 2024 @02:11AM (#39881858)
Yes, well, there actually was a conspiracy here, wasn't there? The only question is how extensive it was in time and space.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by kimixa on Sunday March 31, 2024 @04:32AM (#39882486)
I wonder if the fact they "had" to use a dependency and jump through a number of hoops suggest they're not involved in the conspiracy? As if they had this sort of access and effort surely systemd itself would be an easier target?

But that's not saying this is the only conspiracy, maybe there's hundreds of other similar things in published code right now, and one was noticed soon after introduction merely due to luck.

[ Parent | on HN ]