[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <n13o1633-6409-9p3p-95or-94on654ps8s4@vanv.qr>
Date: Sun, 31 Mar 2024 01:23:28 +0100 (CET)
From: Jan Engelhardt <jengelh@...i.de>
To: oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to
ssh server compromise
On Saturday 2024-03-30 21:43, Mats Wichmann wrote:
> On 3/30/24 09:32, Jeffrey Walton wrote:
>
>>> Someone asked what would become of xz as a project. I do hope in
>>> light of this event, some people step in to help.
>>
>> Perhaps Lasse should turn over control of the project to an entity
>
> In light of this scenario (at least what I understand about it),
> it's got to be even harder now for an overloaded maintainer to
> accept help of a significant nature.
I think it may not make much of a difference.
In the instance of xz, the usurper convinced maintainers with
contributions over the course of some 2 years to gain reasonable
control of the project, and in essence, users.
If instead, we picture that a maintainer withholds control (either due
to lack of will, or lack of time), an usurper would have to start a fork
and convince *users* directly to trust and favor the replacement, an
undertaking which might have reasonably taken about 2-3 years as well
(judging from the timeframes it took libjpeg-turbo or systemd to get a
footing in distros).
Other software might have completely different "usurp time"
characteristics. That all depends on both how integrated a software
is in the larger ecosystem and how many users there already are that
would care (for either an improvement or when it breaks).
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
