Technologist vs spy: the xz backdoor debate
lcamtuf.substack.com
Well — we just witnessed one of the most daring infosec capers of my career. Here’s what we know so far: some time ago, an unknown party evidently noticed that liblzma (aka xz) — a relatively obscure open-source compression library — was a dependency of

Thought this was a good read exploring some how the "how and why" including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

  • tetris11@lemmy.ml
    ·
    8 months ago

    Boostrapping a full distribution from a 357-byte seed file is possible in GUIX:

    https://lemmy.ml/post/8046326

    If that seed is compromised, then the whole software stack just won't build.

    It's an answer to the "Trusting Trust" problem outlined by Ken Thompson in 1984.