XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tevon on Saturday March 30, 2024 @08:49PM (#39880261)

Currently if you visit the xz repository it is disabled for violating github's TOS.

While it should clearly be disabled, I feel like github should leave the code and history up, while displaying a banner (and disabled any features that could be exploited), so that researchers and others can learn about the exploit.

In more minor situations when a library is hosting malicious code, if I found the repo to be down I might not think anything of it.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by jhfdbkofdchk on Saturday March 30, 2024 @08:54PM (#39880287)

I imagine they don’t want automation downloading it.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by Randalthorro on Saturday March 30, 2024 @09:47PM (#39880584)

You can find GitHub events from the repo as a csv here https://github.com/emirkmo/xz-backdoor-github

If you are interested in the source code that is easy to find. This code and git repo are linked all over the world, in many git repos, and the source is bundled many times in releases as well.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by shp0ngle on Sunday March 31, 2024 @01:48AM (#39881782)

xz has its own git mirror where you can see all the commits

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by junon on Sunday March 31, 2024 @10:17AM (#39884497)

Notably only writable by Lasse who I personally believe is a Good Actor here.

[ Parent | on HN ]