Technologist vs spy: the xz backdoor debate
lcamtuf.substack.com
Well — we just witnessed one of the most daring infosec capers of my career. Here’s what we know so far: some time ago, an unknown party evidently noticed that liblzma (aka xz) — a relatively obscure open-source compression library — was a dependency of

Thought this was a good read exploring some how the "how and why" including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

  • lemmyreader@lemmy.ml
    ·
    8 months ago

    "Paid for by a state actor" Yes, who knows.

    • Could be a lone "black hat" or a group of "black hats". Who knows.

    • Could be the result of a lot of public criticism in the news regarding Pegasus spyware. Who knows.

    • Could be paid by companies without any state actors involved. Who knows.

    • Could be a lone programmer who wants power or is seeking revenge for some heated mailing list discussion. Who knows.

    The question of trust has been mentioned in this case of a sole maintainer with health problems. What I asked myself is : How did this trust develop years ago ? People trusted Linus Torvalds and used the Linux kernel to build Linux distributions with to the point that the Linux kernel became from a tiny hobby thing a giant project. At some point compiling from source code became less fashionable and most people downloaded and installed binaries. New projects started and instead of tar and gzip things like xz and zstd were embraced. When do you trust a person or a project, and who else gets on board of a project ? Nowadays something like :

    curl -sSL https://yadayada-flintstones-revival.com | bash

    is considered perfectly normal as the default installation of some software. Open source software is cool and has kind of produced a sort of revolution in technology but there is still a lot of work to do.