Technologist vs spy: the xz backdoor debate
lcamtuf.substack.com
Well — we just witnessed one of the most daring infosec capers of my career. Here’s what we know so far: some time ago, an unknown party evidently noticed that liblzma (aka xz) — a relatively obscure open-source compression library — was a dependency of

Thought this was a good read exploring some how the “how and why” including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

  • locke@sopuli.xyz
    1·
    6 months ago

    Double-edged sword in this case. Open source is what allowed that backdoor in this case.

    • ILikeBoobies
      1·
      6 months ago

      Introduced by maintainer not a random push

      Closed source software has maintainers as well, the company that makes it

      • locke@sopuli.xyz
        1·
        6 months ago

        I cannot be sure, but I believe Lasse never met “Jia Tan”. You usually don’t get employed by a company writing closed source software without meeting and talking to several people. And since nobody works without a salary, you get some sort of tracking towards the person’s identity as well.