▲ 487 ▼ XZ Utils is back on GitHub and Lasse Collin has been unbanned (github.com) submitted 2 years ago by testeronious@lemmy.world to c/linux@lemmy.ml 58 comments fedilink hide all child comments
[–] Yondoza@sh.itjust.works 34 points 2 years ago (8 children) Can someone provide a summary on what this means? I thought there were malicious exploits in this. Why is it back up and the perpetrator unbanned? permalink fedilink source hideshow 16 child comments replies: [–] Nomad_Scry@lemmy.sdf.org 154 points 2 years ago Lasse Collin is not the perpetrator, that would be "Jia Tan". https://tukaani.org/xz-backdoor/ permalink fedilink source parent [–] pixxelkick@lemmy.world 96 points 2 years ago (1 child) Lasse is the original maintainer of XZ, they have been placed back in their position as sole maintainer. "Jia Tan" was the person who slipped the backdoor into XZ and is now banned. Lasse has already fixed abd removed the backdoor. XZ itself is critical software everyone uses (its one of the main compression/decompression programs used on linux) permalink fedilink source parent hideshow 2 child comments replies: [–] Auli@lemmy.ca 5 points 2 years ago* (3 children) Yes but damage seems to be done. Distros are talking or have moved off of it to zstd. permalink fedilink source parent hideshow 6 child comments replies: [–] bhamlin@lemmy.world 22 points 2 years ago (1 child) There are some, probably. But any exodus will be slow. Xz isn't useless because it was dangerous once. permalink fedilink source parent hideshow 2 child comments replies: [–] intrepid@lemmy.ca 14 points 2 years ago Besides, XZ isn't the only project in such a danger. Banning doesn't solve that problem. They need to put in more funding and eyes. permalink fedilink source parent [–] Calyhre@lemmy.world 10 points 2 years ago I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere permalink fedilink source parent [–] PlexSheep@infosec.pub 10 points 2 years ago (1 child) Zstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know. permalink fedilink source parent hideshow 2 child comments replies: [–] Atemu@lemmy.ml 6 points 2 years ago XZ is a slog to compress and decompress but compresses a bit smaller than zstd. zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format. permalink fedilink source parent [–] 4am@lemm.ee 57 points 2 years ago Exploits were removed. Maintainer who committed them still banned. xz is a critical piece of software. permalink fedilink source parent [–] abc@lemmus.org 41 points 2 years ago There's a Wikipedia article regarding this incident. Have a look: https://en.wikipedia.org/wiki/XZ_Utils_backdoor permalink fedilink source parent [–] bhamlin@lemmy.world 37 points 2 years ago This sounds just like something Jia Tan might say... permalink fedilink source parent [–] treadful@lemmy.zip 36 points 2 years ago (1 child) Don't downvote people asking questions. permalink fedilink source parent hideshow 2 child comments replies: [+] the_third@feddit.de 2 points 2 years ago* (last edited 2 years ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] treadful@lemmy.zip 0 points 2 years ago (1 child) It's just a question. Any implications or tone you perceive here is likely your own projection. Try and read it assuming the poster is asking in good faith. permalink fedilink source parent hideshow 2 child comments replies: [+] the_third@feddit.de 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent [–] silliewous@feddit.nl 36 points 2 years ago The second maintainer was most likely the culprit. permalink fedilink source parent [–] myotherself@lemmings.world 8 points 2 years ago https://github.com/tukaani-project/xz/commit/77a294d98a9d2d48f7e4ac273711518bf689f5c4 permalink fedilink source parent
[–] Nomad_Scry@lemmy.sdf.org 154 points 2 years ago Lasse Collin is not the perpetrator, that would be "Jia Tan". https://tukaani.org/xz-backdoor/ permalink fedilink source parent
[–] pixxelkick@lemmy.world 96 points 2 years ago (1 child) Lasse is the original maintainer of XZ, they have been placed back in their position as sole maintainer. "Jia Tan" was the person who slipped the backdoor into XZ and is now banned. Lasse has already fixed abd removed the backdoor. XZ itself is critical software everyone uses (its one of the main compression/decompression programs used on linux) permalink fedilink source parent hideshow 2 child comments replies: [–] Auli@lemmy.ca 5 points 2 years ago* (3 children) Yes but damage seems to be done. Distros are talking or have moved off of it to zstd. permalink fedilink source parent hideshow 6 child comments replies: [–] bhamlin@lemmy.world 22 points 2 years ago (1 child) There are some, probably. But any exodus will be slow. Xz isn't useless because it was dangerous once. permalink fedilink source parent hideshow 2 child comments replies: [–] intrepid@lemmy.ca 14 points 2 years ago Besides, XZ isn't the only project in such a danger. Banning doesn't solve that problem. They need to put in more funding and eyes. permalink fedilink source parent [–] Calyhre@lemmy.world 10 points 2 years ago I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere permalink fedilink source parent [–] PlexSheep@infosec.pub 10 points 2 years ago (1 child) Zstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know. permalink fedilink source parent hideshow 2 child comments replies: [–] Atemu@lemmy.ml 6 points 2 years ago XZ is a slog to compress and decompress but compresses a bit smaller than zstd. zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format. permalink fedilink source parent
[–] Auli@lemmy.ca 5 points 2 years ago* (3 children) Yes but damage seems to be done. Distros are talking or have moved off of it to zstd. permalink fedilink source parent hideshow 6 child comments replies: [–] bhamlin@lemmy.world 22 points 2 years ago (1 child) There are some, probably. But any exodus will be slow. Xz isn't useless because it was dangerous once. permalink fedilink source parent hideshow 2 child comments replies: [–] intrepid@lemmy.ca 14 points 2 years ago Besides, XZ isn't the only project in such a danger. Banning doesn't solve that problem. They need to put in more funding and eyes. permalink fedilink source parent [–] Calyhre@lemmy.world 10 points 2 years ago I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere permalink fedilink source parent [–] PlexSheep@infosec.pub 10 points 2 years ago (1 child) Zstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know. permalink fedilink source parent hideshow 2 child comments replies: [–] Atemu@lemmy.ml 6 points 2 years ago XZ is a slog to compress and decompress but compresses a bit smaller than zstd. zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format. permalink fedilink source parent
[–] bhamlin@lemmy.world 22 points 2 years ago (1 child) There are some, probably. But any exodus will be slow. Xz isn't useless because it was dangerous once. permalink fedilink source parent hideshow 2 child comments replies: [–] intrepid@lemmy.ca 14 points 2 years ago Besides, XZ isn't the only project in such a danger. Banning doesn't solve that problem. They need to put in more funding and eyes. permalink fedilink source parent
[–] intrepid@lemmy.ca 14 points 2 years ago Besides, XZ isn't the only project in such a danger. Banning doesn't solve that problem. They need to put in more funding and eyes. permalink fedilink source parent
[–] Calyhre@lemmy.world 10 points 2 years ago I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere permalink fedilink source parent
[–] PlexSheep@infosec.pub 10 points 2 years ago (1 child) Zstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know. permalink fedilink source parent hideshow 2 child comments replies: [–] Atemu@lemmy.ml 6 points 2 years ago XZ is a slog to compress and decompress but compresses a bit smaller than zstd. zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format. permalink fedilink source parent
[–] Atemu@lemmy.ml 6 points 2 years ago XZ is a slog to compress and decompress but compresses a bit smaller than zstd. zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format. permalink fedilink source parent
[–] 4am@lemm.ee 57 points 2 years ago Exploits were removed. Maintainer who committed them still banned. xz is a critical piece of software. permalink fedilink source parent
[–] abc@lemmus.org 41 points 2 years ago There's a Wikipedia article regarding this incident. Have a look: https://en.wikipedia.org/wiki/XZ_Utils_backdoor permalink fedilink source parent
[–] bhamlin@lemmy.world 37 points 2 years ago This sounds just like something Jia Tan might say... permalink fedilink source parent
[–] treadful@lemmy.zip 36 points 2 years ago (1 child) Don't downvote people asking questions. permalink fedilink source parent hideshow 2 child comments replies: [+] the_third@feddit.de 2 points 2 years ago* (last edited 2 years ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] treadful@lemmy.zip 0 points 2 years ago (1 child) It's just a question. Any implications or tone you perceive here is likely your own projection. Try and read it assuming the poster is asking in good faith. permalink fedilink source parent hideshow 2 child comments replies: [+] the_third@feddit.de 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent
[+] the_third@feddit.de 2 points 2 years ago* (last edited 2 years ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] treadful@lemmy.zip 0 points 2 years ago (1 child) It's just a question. Any implications or tone you perceive here is likely your own projection. Try and read it assuming the poster is asking in good faith. permalink fedilink source parent hideshow 2 child comments replies: [+] the_third@feddit.de 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent
[–] treadful@lemmy.zip 0 points 2 years ago (1 child) It's just a question. Any implications or tone you perceive here is likely your own projection. Try and read it assuming the poster is asking in good faith. permalink fedilink source parent hideshow 2 child comments replies: [+] the_third@feddit.de 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent
[+] the_third@feddit.de 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent
[–] silliewous@feddit.nl 36 points 2 years ago The second maintainer was most likely the culprit. permalink fedilink source parent
[–] myotherself@lemmings.world 8 points 2 years ago https://github.com/tukaani-project/xz/commit/77a294d98a9d2d48f7e4ac273711518bf689f5c4 permalink fedilink source parent