News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by streb-lo on Sunday March 31, 2024 @03:55PM (#39887501)
systemd is just fine on Arch without this patch.

It's not a systemd issue, it's a larger cultural issue with packagers increasing attack surface to make their lives easier.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by bbarnett on Sunday March 31, 2024 @04:38PM (#39887875)
It absolutely, positively, 100% was added due to issues with systemd.

Both Redhat and Debian and others applied this patch as a result. People didn't do it "just cause".

https://bugzilla.redhat.com/show_bug.cgi?id=1381997

Jakub Jelen 2016-10-12 08:40:44 UTC

<snip>

> Why do you want to avoid sd_notify()?

Why to avoid this? Well, it is adding more systemd-specific bits and new build dependency to something that always worked well under other inits without any problems for years.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by streb-lo on Sunday March 31, 2024 @10:46PM (#39890423)
They chose the worst solution to a problem that had multiple better solutions because of a pre-existing patch was the easiest path forward. That’s exactly what I’m talking about.
[ Parent | on HN ]