Technologist vs spy: the xz backdoor debate
lcamtuf.substack.com
Well — we just witnessed one of the most daring infosec capers of my career. Here’s what we know so far: some time ago, an unknown party evidently noticed that liblzma (aka xz) — a relatively obscure open-source compression library — was a dependency of

Thought this was a good read exploring some how the “how and why” including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

  • Lemmchen@feddit.de
    10·
    8 个月前

    Consider this the exception to the rule. There’s no reason we should assume this timeline is the norm.

    • Kindness@lemmy.ml
      2·
      8 个月前

      True. Though remarkable is still remarkable.

      Notably, the timeline post-discovery is still stellar, regardless of Microsoft/GitHub cock-blocking analysis.