Re:Timeline of the xz open source attack
by Denvercoder9 on Tuesday April 02, 2024 @11:51AM
(#39907157)
> Another point relevant on the timeline is when downstream starts using binaries instead of source.
No downstream was using binaries instead of source. Debian and Fedora rebuild everything from source, they don't use the binaries supplied by the maintainer. The backdoor was inserted into the build system.
No downstream was using binaries instead of source. Debian and Fedora rebuild everything from source, they don't use the binaries supplied by the maintainer. The backdoor was inserted into the build system.