Best of 2024

The blog posts Hacker News loved most in 2024. 221 posts.

Open Source
5

Timeline of the xz open source attack

Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…

12

Our audit of Homebrew

This is a joint post with the Homebrew maintainers; read their announcement here! Last summer, we performed an audit of Homebrew. Our audit’s scope included Homebrew/brew itself (home of the brew CLI), and three adjacent repositories responsible for various security-relevant aspects of Homebrew’s operation…

24

The xz attack shell script

Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…

25

Inkscape 1.4

After months of waiting, we are finally ready to unbox the latest version of Inkscape... meet 1.4, the Geek edition, where accessibility and customization reign. Inkscape project developers, most of them volunteer contributors from countries around the world, have been plugging away behind the scenes on new features…