this post was submitted on 29 Mar 2024
173 points (98.3% liked)

Selfhosted

40359 readers
304 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] tal@lemmy.today 39 points 8 months ago* (last edited 8 months ago) (2 children)

Man, there is a lot of concerning stuff there.

In particular, one person commented that the original xz maintainer was possibly subjected to a pressure campaign to hand over maintainership.

Another interesting data point: about 2 years ago there was a clear pressure campaign to name a new maintainer:

https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.html

At the time I thought it was just rude, but maybe this is when it all started.

I don't know how many open-source project maintainers would be on guard for something that subtle, people coordinating to take over maintainership of a project.

I mean, xz isn't normally something you'd immediately think of as security-critical. I doubt that a maintainer knows or thinks about about all the potential downstream dependencies (in this case, not even a standard sshd depedendency, but one that came up because of a patch that Debian used to add some systemd functionality).

EDIT:

I mean, xz isn't normally something you'd immediately think of as security-critical.

On second thought, it actually is, given that Debian packages are xz-compressed.

[–] Moonrise2473@feddit.it 6 points 8 months ago

Wow

And for a state sponsored attacker is cheaper to bribe (or threaten to kill, even cheaper) the single developer to add a backdoor than all the research to find a zero day

load more comments (1 replies)