Excellent succinct breakdown of the xz mess, from an OpenBSD developer
1–10 of 54 posts
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#2> much of the emerging narrative about this backdoor that you can read all over the net is based on idle speculation
...which sums up the situation quite nicely.
This was a pretty bad attack on a certain ecosystem. The ecosystem will recover, or not, regardless of your feelings. Unless you're in a position to truly make a difference, just sit back and enjoy the ride...
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#3This one was much clearer to me: https://research.swtch.com/xz-script
Discussion: https://news.ycombinator.com/item?id=39903685
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#4[deleted]
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#5> Liblzma ends up dynamically linked to sshd because of a
systemd-related extension added by many Linux packagers that pulls
in liblzma as an unrelated dependency
kinda wish this was unpacked a bit more, why exactly is a service executable dynamically linking to a library without using any of its symbols or functions, because of systemd.
and a follow up if some openbsd folks can comment. over the years i've read about various unique security capabilities in openbsd, it seems natural to ask, what kernel or OS capabilities does openbsd provide to thwart the stage 2 efforts for this class of injection techniques?
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#6There really is an exception to every rule. "Do not attribute to malice that which can be adequately explained by neglect, ignorance or incompetence" and then you come across:
> The stage 0 shell snippet looks at first glance like a plausible part of > the poorly readable autoconf/automake tooling.
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#7Yes, the concluding paragraph is the most succinct (and fitting) here, there are better explanations as for the technical aspects. I know it's not related, but for the Germans around, this is just great: https://inka.de/angebot/
A community ISP. Last changed 02.05.2001, in case you missed it. ;) Millennium blues. I wasn't aware about the possibilities back then, but it's just before my time.
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#8> Liblzma ends up dynamically linked to sshd because of a systemd-related extension added by many Linux packagers that pulls in liblzma as an unrelated dependency kinda wish this was unpacked a bit more, why exactly is a service executable dynamically linking to a library without using any of its symbols or functions, because of systemd. and a follow up if some openbsd folks can comment. over the years i've read abou…
[dead]
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#9> It does not plausibly pass for a typo because no typical editing glitch will
leave a '.' character there.
I would certainly attribute that to a typo if I was reviewing the code.
Re: Excellent succinct breakdown of the xz mess, from an OpenBSD developer
#10> It does not plausibly pass for a typo because no typical editing glitch will leave a '.' character there. I would certainly attribute that to a typo if I was reviewing the code.
> The syntax error is a single period '.' as the first character on an otherwise empty line of C code.
I believe the point is that given this context, it could/should not be construed as a typo.