testeronious@lemmy.world to Linux@lemmy.ml · 7 months agoXZ Utils is back on GitHub and Lasse Collin has been unbannedgithub.comexternal-linkmessage-square59fedilinkarrow-up1493arrow-down15
arrow-up1488arrow-down1external-linkXZ Utils is back on GitHub and Lasse Collin has been unbannedgithub.comtesteronious@lemmy.world to Linux@lemmy.ml · 7 months agomessage-square59fedilink
minus-squareYondoza@sh.itjust.workslinkfedilinkarrow-up60arrow-down27·7 months agoCan someone provide a summary on what this means? I thought there were malicious exploits in this. Why is it back up and the perpetrator unbanned?
minus-squareNomad Scry@lemmy.sdf.orglinkfedilinkEnglisharrow-up155·7 months agoLasse Collin is not the perpetrator, that would be “Jia Tan”. https://tukaani.org/xz-backdoor/
minus-squarepixxelkick@lemmy.worldlinkfedilinkarrow-up96·7 months agoLasse is the original maintainer of XZ, they have been placed back in their position as sole maintainer. “Jia Tan” was the person who slipped the backdoor into XZ and is now banned. Lasse has already fixed abd removed the backdoor. XZ itself is critical software everyone uses (its one of the main compression/decompression programs used on linux)
minus-squareAuli@lemmy.calinkfedilinkEnglisharrow-up10arrow-down5·edit-27 months agoYes but damage seems to be done. Distros are talking or have moved off of it to zstd.
minus-squareBillegh@lemmy.worldlinkfedilinkarrow-up22arrow-down1·7 months agoThere are some, probably. But any exodus will be slow. Xz isn’t useless because it was dangerous once.
minus-squareintrepid@lemmy.calinkfedilinkarrow-up13·7 months agoBesides, XZ isn’t the only project in such a danger. Banning doesn’t solve that problem. They need to put in more funding and eyes.
minus-squarePlexSheep@infosec.publinkfedilinkarrow-up10·7 months agoZstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know.
minus-squareCalyhre@lemmy.worldlinkfedilinkarrow-up9·7 months agoI would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere
minus-square4am@lemm.eelinkfedilinkarrow-up58arrow-down1·7 months agoExploits were removed. Maintainer who committed them still banned. xz is a critical piece of software.
minus-squarexyz@lemmus.orglinkfedilinkEnglisharrow-up41arrow-down1·7 months agoThere’s a Wikipedia article regarding this incident. Have a look: https://en.wikipedia.org/wiki/XZ_Utils_backdoor
minus-squareBillegh@lemmy.worldlinkfedilinkarrow-up37·7 months agoThis sounds just like something Jia Tan might say…
minus-squaresilliewous@feddit.nllinkfedilinkarrow-up37arrow-down1·7 months agoThe second maintainer was most likely the culprit.
minus-squaretreadful@lemmy.ziplinkfedilinkEnglisharrow-up41arrow-down5·7 months agoDon’t downvote people asking questions.
minus-squarethe_third@feddit.delinkfedilinkarrow-up2·7 months agoUsually, yes, I am a bit tempted here though.
minus-squaretreadful@lemmy.ziplinkfedilinkEnglisharrow-up1arrow-down1·7 months agoIt’s just a question. Any implications or tone you perceive here is likely your own projection. Try and read it assuming the poster is asking in good faith.
minus-squareIch, einfach anders@lemmings.worldlinkfedilinkarrow-up8·7 months agohttps://github.com/tukaani-project/xz/commit/77a294d98a9d2d48f7e4ac273711518bf689f5c4
Can someone provide a summary on what this means? I thought there were malicious exploits in this. Why is it back up and the perpetrator unbanned?
Lasse Collin is not the perpetrator, that would be “Jia Tan”.
https://tukaani.org/xz-backdoor/
Lasse is the original maintainer of XZ, they have been placed back in their position as sole maintainer.
“Jia Tan” was the person who slipped the backdoor into XZ and is now banned.
Lasse has already fixed abd removed the backdoor.
XZ itself is critical software everyone uses (its one of the main compression/decompression programs used on linux)
Yes but damage seems to be done. Distros are talking or have moved off of it to zstd.
There are some, probably. But any exodus will be slow. Xz isn’t useless because it was dangerous once.
Besides, XZ isn’t the only project in such a danger. Banning doesn’t solve that problem. They need to put in more funding and eyes.
Zstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know.
I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere
Exploits were removed. Maintainer who committed them still banned. xz is a critical piece of software.
There’s a Wikipedia article regarding this incident. Have a look: https://en.wikipedia.org/wiki/XZ_Utils_backdoor
This sounds just like something Jia Tan might say…
The second maintainer was most likely the culprit.
Don’t downvote people asking questions.
Usually, yes, I am a bit tempted here though.
It’s just a question. Any implications or tone you perceive here is likely your own projection.
Try and read it assuming the poster is asking in good faith.
I’m trying, I’m trying.
https://github.com/tukaani-project/xz/commit/77a294d98a9d2d48f7e4ac273711518bf689f5c4