News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by cqqxo4zV46cp on Saturday March 30, 2024 @07:28PM (#39879662)
No. You are still bitter about systemd and are trying to assert blame which does not reasonably exist.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by inferiorhuman on Saturday March 30, 2024 @07:38PM (#39879742)
I'm not bitter, I'm wary of systemd in a security context. Their vulns seem to be a result of poor choices made deliberately rather than mistakes or sloppy coding (e.g. defaulting to running units as root when the UID/username couldn't be parsed). Lennart was staunchly anti-CVE, which to me seems again like making a deliberate choice that will only hinder a secure implementation.

I haven't followed systemd too closely, has their stance on CVEs at least evolved?

https://soylentnews.org/article.pl?sid=17/07/30/0251232

[ Parent | on HN ]