Timeline of the xz open source attack

Re:Timeline of the xz open source attack by thrdbndndn on Tuesday April 02, 2024 @07:16AM (#39904435)

How do you get "Jigar Kumar"'s email address?

I can't seem to find it in the (web version of) the maillist.

Another question:

What is the typo exactly in this commit? I can't seem to find it.

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=a100f9111c8...

[ Parent | on HN ]

Re:Timeline of the xz open source attack by wufocaculura on Tuesday April 02, 2024 @07:34AM (#39904554)

There's a single dot in a line between #include <sys/prcntl.h> and void my_sandbox(void). It is easy to miss, but makes the compile to fail, thus resulting in HAVE_LINUX_LANDLOCK to be never enabled.

[ Parent | on HN ]

Re:Timeline of the xz open source attack by arrowsmith on Tuesday April 02, 2024 @08:36AM (#39905009)

Can someone explain to n00bs like me: what's "landlock" anyway and why is it significant here?

[ Parent | on HN ]

Re:Timeline of the xz open source attack by Denvercoder9 on Tuesday April 02, 2024 @08:45AM (#39905096)

It's a Linux Security Module that allows to sandbox processes: https://docs.kernel.org/userspace-api/landlock.html

[ Parent | on HN ]

Re:Timeline of the xz open source attack by Thorrez on Tuesday April 02, 2024 @08:53AM (#39905172)

prctl, not prcntl

[ Parent | on HN ]

Re:Timeline of the xz open source attack by swsieber on Tuesday April 02, 2024 @07:50AM (#39904682)

> How do you get "Jigar Kumar"'s email address?

Hit reply

[ Parent | on HN ]

Re:Timeline of the xz open source attack by cced on Tuesday April 02, 2024 @07:33AM (#39904549)

I think the period on the line above void my_sandbox.

[ Parent | on HN ]