Not just a day, a full month the backdoor was available. On the Arch Repo, v5.6.0 was uploaded on February 24th. Will be similar to other repos.
Comment on How does the xz incident impacts the average user ? #xz
sneakyninjapants@sh.itjust.works 8 months ago
How does the xz incident impacts the average user ?
It doesn’t.
Average person:
- not running Debian sid, Fedora nightly, or tbh any flavour of Linux.
- ssh service not exposed publicly
The malicious code was discovered within a day or two of upload iirc and presumably very few people were affected by this. There’s more to it but it’s technical and not directly relevant to your question.
For the average person it has no practical impact. For those involved with or interested in software supply chain security, it’s a big deal.
earmuff@lemmy.dbzer0.com 8 months ago
SteveTech@programming.dev 8 months ago
I believe 5.6.0 was in Debian testing for almost a month too.
sneakyninjapants@sh.itjust.works 8 months ago
Thanks for the correction. A full month is much more problematic.
qaz@lemmy.world 8 months ago
You forgot about OpenSUSE Tumbleweed, it also shipped the infected package. I had to update to a newer non-infected version of xz.
sneakyninjapants@sh.itjust.works 8 months ago
Thanks, SUSE completely slipped my mind
Hawk@lemmynsfw.com 8 months ago
What about vpn behind WireGuard/OpenVPV?
I would presume no?
Cryophilia@lemmy.world 8 months ago
I don’t even understand what anyone in this thread is saying.
That’s not an invitation, please don’t explain Linux to me.
I’m just saying this means nothing for average people.
hperrin@lemmy.world 8 months ago
It could have meant a lot to the average person if it wasn’t caught. If this was some adversary, they could have used it to cripple critical infrastructure in the largest cyber attack in history.
earmuff@lemmy.dbzer0.com 8 months ago
It actually means a lot for average people. Only because you are not able to comprehend some things, does not mean you are not affected by it. But feel free to keep on using Windows XP.
maxprime@lemmy.ml 8 months ago
Can I explain GUN/Linux to you?
leave_it_blank@lemmy.world 8 months ago
Isn’t that this Windows imitation I sometimes hear about?
(I have a death wish I guess)
But on a serious side: I need an easy to use Linux system next year for my parents who are not very tech savvy. Do you have a recommendation for easy use that feels like Windows? It will only be used for browsing, open office and stuff.
SendMePhotos@lemmy.world 8 months ago
You can to me. I don’t know what gnu is but I know that Linux is a penguin branch of os
Cryophilia@lemmy.world 8 months ago
No.