The XZ Backdoor Author

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". He worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz project for 2 years, adding all sorts of binary test files, and to be honest with this level of sophistication I would be suspicious of even older versions of xz until proven otherwise.

Скриншот Hacker News с рассказом о том, как автор бэкдора в проекте xz пытался добавить версию xz 5.6.x в Fedora. Ирония в том, что подозрительный разработчик сам помогал исправлять проблему valgrind, которая на самом деле была вызвана добавленным им бэкдором; изображение человека, открывающего дверь, подчёркивает метафору «открыть дверь» для вредоносного кода. EN: A Hacker News screenshot describes how the author of the xz backdoor tried to get xz 5.6.x added to Fedora. The irony is that the suspicious developer helped fix a valgrind issue that was actually caused by the backdoor he had added; the image of a person opening a door emphasizes the metaphor of opening the door for malicious code.

• @gentoomemes / 10250 2024-03-30