News for hackers. Stuff that matters.

A comment on My minute-by-minute response to the LiteLLM malware attack. Parent comment

Re:My minute-by-minute response to the LiteLLM malware attack by dmitrygr on Thursday March 26, 2026 @01:05PM (#47532944)
your link disproves your claim. no naive app depended on xz version >= latest. Most sane distros take time to up-rev. That is why the xz backdoor was, in fact, in NO stable distro

And not changing often is a feature, yes.

[ Parent | on HN ]
Re:My minute-by-minute response to the LiteLLM malware attack by woodruffw on Thursday March 26, 2026 @01:27PM (#47533249)
I don't think it does; I think the industry opinion on xz is that we got lucky in terms of early detection, and that we shouldn't depend on luck.

(I don't know what a "sane" distro is; empirically lots of distros are bleeding-edge, so we need to think about these things regardless of value judgements.)

[ Parent | on HN ]
Re:My minute-by-minute response to the LiteLLM malware attack by dmitrygr on Thursday March 26, 2026 @01:29PM (#47533281)
Sane: debian-stable
[ Parent | on HN ]
Re:My minute-by-minute response to the LiteLLM malware attack by woodruffw on Thursday March 26, 2026 @01:48PM (#47533506)
From experience, a lot of people using a "stable" distro are just bypassing that distro's stability (read: staleness) by installing nightly things from a language ecosystem. It's not clear to me that this is a better (or worse) outcome than a less stable distro.
[ Parent | on HN ]