Topics /

Open Source

The most popular blog posts about open source on Hacker News. 221 posts.

2024
5

Timeline of the xz open source attack

Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…

12

Our audit of Homebrew

This is a joint post with the Homebrew maintainers; read their announcement here! Last summer, we performed an audit of Homebrew. Our audit’s scope included Homebrew/brew itself (home of the brew CLI), and three adjacent repositories responsible for various security-relevant aspects of Homebrew’s operation…

18

Flux: Open-source text-to-image model with 12B parameters

Flux, the largest SOTA open source text-to-image model to date, developed by Black Forest Labs—the original team behind Stable Diffusion is now available on fal. Flux pushes the boundaries of creativity and performance with an impressive 12B parameters, delivering aesthetics reminiscent of Midjourney. To play around…

24

The xz attack shell script

Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…

25

Inkscape 1.4

After months of waiting, we are finally ready to unbox the latest version of Inkscape... meet 1.4, the Geek edition, where accessibility and customization reign. Inkscape project developers, most of them volunteer contributors from countries around the world, have been plugging away behind the scenes on new features…

29

Let's Encrypt is 10 years old now

Vital personal and business information flows over the Internet more frequently than ever, and we don’t always know when it’s happening. It’s clear at this point that encrypting is something all of us should be doing. Then why don’t we use TLS (the successor to SSL) everywhere? Every browser in every device supports…