Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz-utils backdoor has been removed

github.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: The xz-utils backdoor has been removed

#11

Post by red_admiral »

rgovostes wrote: post #4

This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92... While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it's good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines.…

This has to go on the list of "best understatements ever", along with that famous captain's announcement when an ash cloud knocked out all four engines.

Re: The xz-utils backdoor has been removed

#12

Post by nextaccountic »

rgovostes wrote: post #4

This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92... While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it's good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines.…

I would really really really like to see all commits by Jia Tan reverted, not only those currently found to be malicious.

Debian and NixOS (and other distros) are already downgrading or discussing to downgrade to versions without those commits.

I think that making a 5.4 or 5.6 release without any of those commits (with stuff reimplemented as needed) would assuage most concerns

Re: The xz-utils backdoor has been removed

#13

Post by TacticalCoder »

rgovostes wrote: post #4

This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92... While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it's good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines.…

> This commit message is gold

It's really sad to see commit messages like this, downplaying the issue. It's also concerning to see libsystemd get a free pass.

Re: The xz-utils backdoor has been removed

#14

Post by icameron »

nextaccountic wrote: post #12
rgovostes wrote: post #4

This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92... While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it's good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines.…

I would really really really like to see all commits by Jia Tan reverted, not only those currently found to be malicious. Debian and NixOS (and other distros) are already downgrading or discussing to downgrade to versions without those commits. I think that making a 5.4 or 5.6 release without any of those commits (with stuff reimplemented as needed) would assuage most concerns

Who would do that? The project lacking active contributors is what enabled Jai Tan to get away with it in the first place.

Re: The xz-utils backdoor has been removed

#15

Post by [deleted] »

TacticalCoder wrote: post #13
rgovostes wrote: post #4

This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92... While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it's good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines.…

> This commit message is gold It's really sad to see commit messages like this, downplaying the issue. It's also concerning to see libsystemd get a free pass.

[deleted]

Re: The xz-utils backdoor has been removed

#16

Post by Affric »

icameron wrote: post #14
nextaccountic wrote: post #12

Earlier quoted context omitted.

I would really really really like to see all commits by Jia Tan reverted, not only those currently found to be malicious. Debian and NixOS (and other distros) are already downgrading or discussing to downgrade to versions without those commits. I think that making a 5.4 or 5.6 release without any of those commits (with stuff reimplemented as needed) would assuage most concerns

Who would do that? The project lacking active contributors is what enabled Jai Tan to get away with it in the first place.

Can’t we migrate to other libraries?

Re: The xz-utils backdoor has been removed

#17

Post by eigenlicht »

Affric wrote: post #16
icameron wrote: post #14

Earlier quoted context omitted.

Who would do that? The project lacking active contributors is what enabled Jai Tan to get away with it in the first place.

Can’t we migrate to other libraries?

At least in Debian there's already the inevitable discussion about a supposed opportunity for "finally" moving to zstd. Which to me, frankly, feels a bit like getting out of the frying pan and into the fire, or what I think Arch (yuck) did years ago. That's not because I'm so much into xz. It's kind of funny there's a possible Debian connection, of all things, considering that quite a lot authorities and services in areas like China, Russia or Iran are recently migrating, for obvious reasons, from Windows/Mac to more or less home-made (~styled) Linux distributions, that just often happen to be based on Debian. I don't think this is too popular in English speaking countries in particular, but then I really didn't want to chime in on the speculations. ;P

Re: The xz-utils backdoor has been removed

#18

Post by mschuster91 »

zoobab wrote: post #10
throwiforgtnlzy wrote: post #8

Earlier quoted context omitted.

Maybe we need an international NGO/co-op to provide essential services for small, essential FOSS projects such as security comms, security audits, build infrastructure, testing, best practices, background investigations, and so forth. The "one guy's little piece of code holding up the world" is a SPOF and much easier to attack than if they had some help and automation.

"security comms, security audits, build infrastructure, testing, best practices, background investigations, and so forth." Typical over-engineering that comes from large corporations. They will turn FOSS into a walled garden, as if contributing to projects was not a pain already.

> They will turn FOSS into a walled garden, as if contributing to projects was not a pain already.

The only thing in here that has potential negative impact are the background investigations, but it might be reasonable to have an independent third party that offers this as a service for project leads.

Re: The xz-utils backdoor has been removed

#19

Post by cowsandmilk »

TacticalCoder wrote: post #13
rgovostes wrote: post #4

This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92... While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it's good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines.…

> This commit message is gold It's really sad to see commit messages like this, downplaying the issue. It's also concerning to see libsystemd get a free pass.

How did they get a free pass?

Re: The xz-utils backdoor has been removed

#20

Post by b112 »

cowsandmilk wrote: post #19
TacticalCoder wrote: post #13

Earlier quoted context omitted.

> This commit message is gold It's really sad to see commit messages like this, downplaying the issue. It's also concerning to see libsystemd get a free pass.

How did they get a free pass?

Systemd's ridiculous inability to manage daemons correctly, like every other init system on the planet, necessitated debian, redhat, and others patching ssh, just so systemd could reliably start ssh.

Which is what enabled this vulnerability to be viable.

Post reply on HN