[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOp4FwTh_vQ-RGZ0uByqO0Oo6cwUCEECcnNg1cQCqm00H6MLbA@mail.gmail.com>
Date: Wed, 17 Apr 2024 18:52:11 +0400
From: Loganaden Velvindron <loganaden@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
>
> Concerning, yes, but not quite the "Jia Tan" /modus operandi/---"Jia"
> seems to have been contributing patches for some time (with sockpuppets
> pushing their acceptance as needed) before making a move to be appointed
> co-maintainer of xz. This looks to me like the common cybercrooks have
> seen the technique, decided that it sounds like a great idea, and are
> now trying to use it, but do not have the patience that the "Jia Tan"
> gang had. In other words, now the "Nigerian Princes" want to help you
> maintain your project, just give them write access to the source
> repository up front. :-P
>
Hi. Not all Africans try to scam people. There are people in Africa
who contribute
to Linux and Open Source software such as auditing compression
libraries for similar backdoors.
(I'm from an African country - Mauritius - and we have a vibrant
community of FOSS contributors ...)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
