My mastodon feed is full of IT security specialist talking about the xz affair where someone let a backdoor in some library.
But beside showing the two side of Free/Libre software (anybody can add a backdoor, and anybody can spot it), I have no idea how it impacts the average person. Is it a common library or something used only by specific application ? Would my home-grade router protects me ?
sneakyninjapants@sh.itjust.works 7 months ago
It doesn’t.
Average person:
The malicious code was discovered within a day or two of upload iirc and presumably very few people were affected by this. There’s more to it but it’s technical and not directly relevant to your question.
For the average person it has no practical impact. For those involved with or interested in software supply chain security, it’s a big deal.
Cryophilia@lemmy.world 7 months ago
I don’t even understand what anyone in this thread is saying.
That’s not an invitation, please don’t explain Linux to me.
I’m just saying this means nothing for average people.
hperrin@lemmy.world 7 months ago
It could have meant a lot to the average person if it wasn’t caught. If this was some adversary, they could have used it to cripple critical infrastructure in the largest cyber attack in history.
earmuff@lemmy.dbzer0.com 7 months ago
It actually means a lot for average people. Only because you are not able to comprehend some things, does not mean you are not affected by it. But feel free to keep on using Windows XP.
maxprime@lemmy.ml 7 months ago
Can I explain GUN/Linux to you?
earmuff@lemmy.dbzer0.com 7 months ago
Not just a day, a full month the backdoor was available. On the Arch Repo, v5.6.0 was uploaded on February 24th. Will be similar to other repos.
SteveTech@programming.dev 7 months ago
I believe 5.6.0 was in Debian testing for almost a month too.
sneakyninjapants@sh.itjust.works 7 months ago
Thanks for the correction. A full month is much more problematic.
qaz@lemmy.world 7 months ago
You forgot about OpenSUSE Tumbleweed, it also shipped the infected package. I had to update to a newer non-infected version of xz.
sneakyninjapants@sh.itjust.works 7 months ago
Thanks, SUSE completely slipped my mind
Hawk@lemmynsfw.com 7 months ago
What about vpn behind WireGuard/OpenVPV?
I would presume no?