you are viewing a single comment's thread
view the rest of the comments
[–] 31 points 2 years ago (6 children)

The scary thing about this is thinking about potential undetected backdoors similar to this existing in the wild. Hopefully the lessons learned from the xz backdoor will help us to prevent similar backdoors in the future.

  • source
  • hideshow 6 child comments
  • [–] [S] 18 points 2 years ago (5 children)

    I think we need focus on zero trust when it comes to upstream software

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 2 years ago (4 children)

    exactly, stop depending on esoteric libraries

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 1 point 2 years ago (3 children)

    It is fine to use them just know how they work and check the commit log.

    That of course requires you to pull from got instead of a tarball

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 2 years ago (2 children)

    this was well hidden. not sure anyone would have spotted this by checking commit log

  • source
  • parent
  • hideshow 2 child comments