XZ Struck By Malicious Code That Could Allow Unauthorized Remote System Access

[novideo]

It gets even better, they also patched ASAN to not detect the backdoor: https://github.com/google/oss-fuzz/issues/11760

The malware author has managed to push updates into the Linux kernel as well:

https://lore.kernel.org/lkml/2024032...tukaani.org/t/

Now that's terrifying

You are a TROLL, that’s what you are.

I wouldn't say that, it seems that avis/biride genuinely has different values and viewpoints than we do. He is often aggressive, arrogant, and/or stubborn, but his posts seem to contain some intellect unlike sophisticles's. sophisticles is definitely a troll though.

[LightBit]

The Win XP code was supposedly used to build a functional copy of XP.

BTW, the argument you are using here is the same one I have used against Linux for years, you have no way of knowing if the code listed on a distros site is the same that was used to build the ISO you install from.

Thank you for confirming the weakness of open source for me.

Sure, you have to build code yourself with trusted compiler, otherwise it does not make any sense to audit code.
Obviously almost nobody does this, but you can with open source.

[avis]

Now that's terrifying


I wouldn't say that, it seems that avis/biride genuinely has different values and viewpoints than we do. He is often aggressive, arrogant, and/or stubborn, but his posts seem to contain some intellect unlike sophisticles's. sophisticles is definitely a troll though.

I'm not on the Linux hype train that's why "I'm a troll". I also happen to enjoy gaming under Windows because Linux is not there yet and it's very unlikely it will ever be.

Linux is absolutely safe and secure and thanks for the kind words. I have nothing else to say and I'm exhausted by the aggression of the people who have made Linux their religion.

[spicfoo]

Is Red Hat also wrong?

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

The blog quote is misleading but read the rest of the blog and you can readily see for yourself, there is no such thing as a Fedora 41 update. The developers involved directly have confirmed this

https://lists.fedoraproject.org/archives/list/[email protected]/message/63JUTDWU73GXRXL4URQUQHE4KLCHIDDL/

"Can someone from RH check and change the RH article header and the RH CVE page content to avoid confusion? I tend to assume that "F41 and rawhide" makes no sense at all since the two are currently equal."

[spicfoo]

I wouldn't say that, it seems that avis/biride genuinely has different values and viewpoints than we do.

In goes much much worse than that. Birdie was banned in Phoronix and created an alternative user account to continue with this trollish posts. He often claims that even knows better than the developers involved and makes false claims instead of acknowledging his mistakes when others point out evidence against his arguments. For example, he claimed only Red Hat does hardware certification and said SUSE and Ubuntu are lying when I pointed out the links. He also claimed earlier that Red Hat is lying about the burden of Xorg maintenance and claimed it is maintenance free and when Xorg security vulnerabilities were patched later, he further claimed that doesn't count as maintenance.

[Monsterovich]

You started with a wild conspiracy, now you've taken it a step further. Nothing you've said is based in reality and I'm not interested in discussing the things that are the product of your wild imagination. Sorry, I'll leave you right there.

Corporations cannot be trusted, no matter what kind of software they develop closed-source or open-source. Your efforts to defend proprietary garbage are just pathetic.

[HEL88]

It's because Linux takes security seriously. Fixing security bugs introduces regressions. On Windows and macOS regressions are mostly introduced by incompetence. Software developers prefer Linux over mentioned toys, so stop making such claims.

Why is windows so buggy?



Very M$ thing. Break what's broken even more.

https://www.windowslatest.com/2024/0...-issues-bsods/

https://www.google.com/search?q=wind...h+after+update
"windows crash after update" - 160 mln

https://www.google.com/search?q=linu...h+after+update
"Linux crash after update" - 52 mln

https://www.google.com/search?q=maco...h+after+update
"macos crash after update" - 41 mln


Windows has 72% market share, Linux has 4%, MacOS 15%.
Desktop Operating System Market Share Worldwide | Statcounter Global Stats



Linux has only 4% market share. Linux is 18 times less popular than Windows, but people only ask the "crash after update" question 4 times less often.



Eat this. Statistics are merciless for your Linux.

And you only know how to give links without sense and without context.

[andyprough]

You can't find a single post of mine where i have said this.

No, you only implied it by saying "Open source, especially the way it applies to Linux based OSes, gives people a false sense of security."

Anyway, I am blissfully unaware of all this, using a conservative non-rolling distro with version 5.2.5 of xz. What you don't tell people is that your anti-libre-software viewpoint ONLY applies to those that love to live on the white-knuckled bleeding edge of disaster, where development versions are injected directly into their updates without any testing or scrutiny. We're talking people that live on Fedora Developmental Rawhide versions or who cram their systems with the latest git versions of software from the AUR. Such people are no more than alpha software testers, and when things go wrong for them they go very badly wrong. But none of the issues that you or avis have raised today have anything whatsoever to do with the vast majority of us libre software users who stick to long-term stable distros.

[Monsterovich]

If you don't know that there is a virus in there then how do you know that malicious code is already built into the OS such as Windows?

If malware is being added even to open source products, then the chance that malware is already in closed source products is close to 100%. Because people are assholes and corporations are assholes^assholes.

[avis]

A deep dive:

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27