Tootfinder

This couldn't be more relevant with the #xzbackdoor being discovered just recently.
Please note there will be a panel discussion on the XZ event this evening at 18:00 in the ring arena. #javaland
Correction: this panel will take place at 18:00 CET.

That escalated quickly: The #xzbackdoor caused the first domain registration: #xz

I updated it so you don't have to.
#xz #xzbackdoor

#xzbackdoor verdeutlicht nochmal, worum es in den Diskussionen zum #CyerResilienceAct auch ging: das es nicht sein kann, dass #OSS breit kommerziell genutzt wird, es aber aus dieser Nutzu…

lol, the #ReproducibleBuilds people are finally having their day in the sun
(and hey good for them, they've done a lot of work to get to this place!)
#xz #XzBackdoor

The xz backdoor seems to be in all Linux distributions, and given it's in MacOS it's highly likely to be in *bsd as well.
The Good Thing is that those that need to have down graded repositories, so just do whatever flavour of update and it will be fine.
#xzBackdoor

Based on their analysis of working hours, timestamps, and holidays, it seems likely "Jia Tan" worked out of Eastern Europe or Russia while doing the #xzBackdoor ⬆️.
Clever analysis by Rhea Karty and Simon Henniger.
#xz
https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and

The xz backdoor seems to be in all Linux distributions, and given it's in MacOS it's highly likely to be in *bsd as well.
The Good Thing is that those that need to have down graded repositories, so just do whatever flavour of update and it will be fine.
#xzBackdoor

I guess some responsible adult is going to get landed with the xz repo maintenance and release, of which the first act would be to get the security review done and not presume that the first commit from the suspects is actually the first commit.
Who decides?
#xz #xzBackdoor

Oh, btw: I was just made aware of a 4½ minute video that summarizes most of the events and has (what I greatly appreciate) some great real-world analogy for how the backdoor was installed and then detected. Enjoy!
#xz #xzBackdoor
https://www.youtube.com/watch?v=bS9em7Bg0iU

«Die Feiertage. Die ganzen IT-Abteilungen feiern mit der Familie… Die ganzen IT-Abteilungen? Nein! Eine von unbeugsamen Open-Source-Enthusiasten bevölkerte Mailingliste hört nicht auf, den Eindringlingen Widerstand zu leisten.»
#xz #xzbackdoor #lzma #ssh
https://dnip.ch/2024/04/02/xz-open-source-ostern-welt-retten/