1222
XZ backdoor in a nutshell (lemmy.zip)
submitted 2 years ago by to c/linux@lemmy.ml
155 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 243 points 2 years ago (22 children)

Don't forget all of this was discovered because ssh was running 0.5 seconds slower

  • permalink
  • fedilink
  • source
  • hideshow 22 child comments
    •
  • [–] 93 points 2 years ago (2 children)

    Its toooo much bloat. There must be malware XD linux users at there peak!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 82 points 2 years ago (6 children)

    Half a second is a really, really long time.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 26 points 2 years ago (4 children)

    reminds of Data after the Borg Queen incident

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 2 years ago (3 children)

    Which ep/movie are you referring to?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 54 points 2 years ago

    Technically that wasn't the initial entrypoint, paraphrasing from https://mastodon.social/@AndresFreundTec/112180406142695845 :

    It started with ssh using unreasonably much cpu which interfered with benchmarks. Then profiling showed that cpu time being spent in lzma, without being attributable to anything. And he remembered earlier valgrind issues. These valgrind issues only came up because he set some build flag he doesn't even remember anymore why it is set. On top he ran all of this on debian unstable to catch (unrelated) issues early. Any of these factors missing, he wouldn't have caught it. All of this is so nuts.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 34 points 2 years ago (7 children)

    Is that from the Microsoft engineer or did he start from this observation?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 45 points 2 years ago (6 children)

    From what I read it was this observation that led him to investigate the cause. But this is the first time I read that he's employed by Microsoft.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 15 points 2 years ago (5 children)

    I've seen that claim a couple of places and would like a source. It very well may be since Microsoft prefers Debian based systems for WSL and for azure, but its not something I would have assumed by default

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •