Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Mar 2024 15:19:38 -0700
From: Andres Freund <>
Subject: Re: Re: backdoor in upstream xz/liblzma leading to
 ssh server compromise


On 2024-03-29 21:54:11 -0000, Tavis Ormandy wrote:
> On 2024-03-29, Solar Designer wrote:
> >> I have a minor procedural question for Solar though, shouldn't this
> >> have been redirected to oss-security immediately from distros? What's
> >> the rationale for an embargo here?
> >
> > We don't have a clear policy for such case.  Some distros list members
> > have indeed suggested making this public ASAP.  We ended up delaying
> > publication by one day per my suggestion (as a compromise between ASAP
> > and having no specific CRD), and I think these are some reasons why:
> Thanks, a compromise is better than nothing :) I think I would have
> argued for immediately discussing this in the open.

FWIW, I don't know much of the tradeoffs in this space. With that caveat:

Personally I would have felt quite hesitant to post to distros@ if I knew that
distros wouldn't get a reasonable, small, amount of time to prepare, so they
have fixed packages available at the time of the public posting.

> > 2. We didn't know how the culprit (or group) would react when they
> > learned of the full extent of the community's awareness.
> This is true with any vulnerability, there is always the possibility an
> attacker is already aware of it. They could respond to a patch being
> released by trying to extract as much value from their exploit before
> it's worthless.
> I'm not convinced that's a good argument to delay making the patch
> available?

What patch? You mean going back to an older version?


Andres Freund

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.