News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by guenthert on Sunday March 31, 2024 @10:59AM (#39884858)
Or is it rather like someone posting a video on youtube on how to pick a common lock?

And what's about the fellows of U of Minnesota?

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tempay on Sunday March 31, 2024 @01:18PM (#39886067)
It’s more analogous to getting hired at the lock company and sabotaging the locks you assemble to be trivially pickible if you know the right trick.

The University of Minnesota case is an interesting one to compare to. I could imagine them being criminally liable but being given a lenient punishment. I wonder if the law will end up being amended to better cover this, if it isn’t already explicitly illegal.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by brokenmachine on Monday April 01, 2024 @11:04PM (#39901981)
What happened at the University of Minnesota?
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tempay on Tuesday April 02, 2024 @02:47AM (#39903012)
They intentionally tried to contribute security bugs into the linux kernel as a research project: https://lwn.net/Articles/854645/
[ Parent | on HN ]