1
Everything I Know About the XZ Backdoor
Please note: This is being updated in real-time. The intent is to make sense of lots of simultaneous discoveries
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 7 posts.
2
Timeline of the xz open source attack
Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…
3
A Bug in Early Creative Commons Licenses Has Enabled Copyleft Trolls (2022)
Copyleft trolls, robosigning, and Pixsy.
4
The xz attack shell script
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…
5
Orphaning bcachefs-tools in Debian
Around a decade ago, I was happy to learn about bcache – a Linux block cache system that implements tiered storage (like a pool of hard disks with SSDs for cache) on Linux. At that stage, ZFS on Linux was nowhere close to where it is today, so any progress on gaining more ZFS features in general Linux systems was very…
6
Cracking an old ZIP file to help open source the ANC's "Vula" secret crypto code
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
7
KDE Asking for Donations
Why do we ask for donations so often? Because it’s important! As KDE becomes more successful and an increasing number of people use our software, our costs grow as well: Web and server hostin…