[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <97E4F613-4AE1-4113-8429-F6A66F566DD3@boanderson.me>
Date: Sat, 30 Mar 2024 13:30:28 +0000
From: Bo Anderson <mail@...nderson.me>
To: oss-security@...ts.openwall.com
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
> On 30 Mar 2024, at 02:48, Tavis Ormandy <taviso@...il.com> wrote:
>
> Yeah, you're making big decisions for a lot of people here.
>
> If your organization was not on the list and got compromised during the
> embargo, do you think you would be thanking everyone for delaying your
> response?
I think this is a good point to keep in mind.
In this case, I think things were dealt with ok. We believe the main target was deb/rpm builds and those people were given some notice about the situation.
However in the wider sense of malware and potentially certain 0-days, it is important to remember distros@ is absolutely not the only people that need to know about some of these things.
For example, distros@ excludes package managers on macOS and Windows. To pick out one to demonstrate, xz 5.6.1 on Homebrew received over 1.5 million downloads by the time it was pulled (of which at least 20% of that was definitely installed). It is very fortunate that we believe the scope was limited to Linux.
And even when you escape the package manager world, there are many people who incorporate these dependencies as a part of their own builds. Redistribution of libraries with software (both shared and static) is quite common outside of the Linux sphere.
Bo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
