XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by everybackdoor on Saturday March 30, 2024 @07:59PM (#39879888)

This message and others like it feel like a concerted effort at damage control around systemd.

Essentially, the optics here are that an intelligence agency created systemd to be used as a secret garden, and then manufactured community support for it using social engineering (”you’re too stupid/old/bitter to understand the complex marvel we’ve created”) and now we’re all living in la-la land when it comes to computer security.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by rcxdude on Saturday March 30, 2024 @08:36PM (#39880166)

This is full conspiracy mode thinking.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by webmaven on Sunday March 31, 2024 @02:11AM (#39881858)

Yes, well, there actually was a conspiracy here, wasn't there? The only question is how extensive it was in time and space.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by kimixa on Sunday March 31, 2024 @04:32AM (#39882486)

I wonder if the fact they "had" to use a dependency and jump through a number of hoops suggest they're not involved in the conspiracy? As if they had this sort of access and effort surely systemd itself would be an easier target?

But that's not saying this is the only conspiracy, maybe there's hundreds of other similar things in published code right now, and one was noticed soon after introduction merely due to luck.

[ Parent | on HN ]