News for hackers. Stuff that matters.
Re:Could the XZ backdoor been detected with better Git/Deb p... by crote on Sunday October 19, 2025 @06:14PM (#45638523)
Yes, but the carefully crafted bad data should be explainable.

Instead of committing blobs, why not commit documented code which generates those blobs? For example, have a script compress a bunch of bytes of well-known data, then have it manually corrupt the bytes belonging to file size in the archive header.

Re:Could the XZ backdoor been detected with better Git/Deb p... by uecker on Monday October 20, 2025 @03:01AM (#45640729)
Maybe, but it is generally much more work to do than including a minimized test case which may already exist. But I would argue that binary blobs for testing are not the problem but the code that allows things from a binary blob to be executed during building and/or later at run-time.