News for hackers. Stuff that matters.

A comment on Xzbot: Notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094). Parent comment

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by mistrial9 on Monday April 01, 2024 @06:36PM (#39900208)
> an MS engineer

no this engineer is world-known for being core PostgreSQL, a team with high standards.. unlike that company you mention

[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by est31 on Monday April 01, 2024 @07:40PM (#39900713)
Yeah definitely, good point. I got that wrong above: He is in fact a postgres contributor who happens to be MS employee and not an MS employee who happens to be a postgres contributor.
[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by jeltz on Tuesday April 02, 2024 @01:42AM (#39902739)
He is also one of the sharpest developers I have had the fortune to speak to (and do some minor work with on the mailing list) and he knows a lot about performance and profiling. I 100% think that he found it on his own. He would also be an odd choice for Microsoft to pick since I doubt he works anywhere close to any of their security teams (unless they went through some serious lengths to find just the guy where it would be 100% believable that he just stumbled on it).
[ Parent | on HN ]