Proudly Updating One Package

Finally I found the time to update some packages on my laptop. I feel so proud. ==> Upgrading 1 outdated package: xz 5.5.0 -> 5.6.0 ==> Downloading https://ghcr.io/v2, ############################################################ ==> Fetching xz ==> Downloading https://ghcr.io/v2, ############################################################

A social media post proudly announces finally updating packages on a laptop, but the terminal shows the infamous xz package being downloaded from a registry. The joke is that xz 5.6.0 was associated with a serious supply-chain backdoor incident, so the innocent-looking update is darkly ironic and works as a reaction to risky software updates. EN: A social media post proudly announces finally updating packages on a laptop, but the terminal shows the infamous xz package being downloaded from a registry. The joke is that xz 5.6.0 was associated with a serious supply-chain backdoor incident, so the innocent-looking update is darkly ironic and works as a reaction to risky software updates.

• @gentoomemes / 10293 2024-03-31