Comment

Comment on How does the xz incident impacts the average user ? #xz

sneakyninjapants@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

How does the xz incident impacts the average user ?

It doesn’t.

Average person:

not running Debian sid, Fedora nightly, or tbh any flavour of Linux.
ssh service not exposed publicly

The malicious code was discovered within a day or two of upload iirc and presumably very few people were affected by this. There’s more to it but it’s technical and not directly relevant to your question.

For the average person it has no practical impact. For those involved with or interested in software supply chain security, it’s a big deal.

source

Sort:hotnew top

Cryophilia@lemmy.world ⁨2⁩ ⁨months⁩ ago
I don’t even understand what anyone in this thread is saying.

That’s not an invitation, please don’t explain Linux to me.

I’m just saying this means nothing for average people.

source
- hperrin@lemmy.world ⁨2⁩ ⁨months⁩ ago
  It could have meant a lot to the average person if it wasn’t caught. If this was some adversary, they could have used it to cripple critical infrastructure in the largest cyber attack in history.
  
  source
- earmuff@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago
  It actually means a lot for average people. Only because you are not able to comprehend some things, does not mean you are not affected by it. But feel free to keep on using Windows XP.
  
  source
- maxprime@lemmy.ml ⁨2⁩ ⁨months⁩ ago
  Can I explain GUN/Linux to you?
  
  source
  - leave_it_blank@lemmy.world ⁨2⁩ ⁨months⁩ ago
    Isn’t that this Windows imitation I sometimes hear about?
    
    (I have a death wish I guess)
    
    But on a serious side: I need an easy to use Linux system next year for my parents who are not very tech savvy. Do you have a recommendation for easy use that feels like Windows? It will only be used for browsing, open office and stuff.
    
    source
  - SendMePhotos@lemmy.world ⁨2⁩ ⁨months⁩ ago
    You can to me. I don’t know what gnu is but I know that Linux is a penguin branch of os
    
    source
  - Cryophilia@lemmy.world ⁨2⁩ ⁨months⁩ ago
    No.
    
    source
earmuff@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago
Not just a day, a full month the backdoor was available. On the Arch Repo, v5.6.0 was uploaded on February 24th. Will be similar to other repos.

source
- SteveTech@programming.dev ⁨2⁩ ⁨months⁩ ago
  I believe 5.6.0 was in Debian testing for almost a month too.
  
  source
- sneakyninjapants@sh.itjust.works ⁨2⁩ ⁨months⁩ ago
  Thanks for the correction. A full month is much more problematic.
  
  source
qaz@lemmy.world ⁨2⁩ ⁨months⁩ ago
You forgot about OpenSUSE Tumbleweed, it also shipped the infected package. I had to update to a newer non-infected version of xz.

source
- sneakyninjapants@sh.itjust.works ⁨2⁩ ⁨months⁩ ago
  Thanks, SUSE completely slipped my mind
  
  source
Hawk@lemmynsfw.com ⁨2⁩ ⁨months⁩ ago
What about vpn behind WireGuard/OpenVPV?

I would presume no?

source