Hacker News Reader

Have the heads of the targeted projects - including xz (Lasse Collin?), OpenSSH (Theo?), and Linux (Linus) - commented on it?

I'm especially interested in how such exploits can be prevented in the future.

View on HN

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b...:

>Lasse regularly has internet breaks and is on one at the moment, started before this all kicked off. He has posted an update at https://tukaani.org/xz-backdoor/ and is working with the community.

OpenSSH and Linux were not targeted/affected.

xz and the Debian distribtion of OpenSSH were targeted.

Fedora too.

The core source of the vulnerability (symbol lookup order allowing a dependency to preempt a function) might theoretically be fixed at the Linux+OpenSSH level.

It's in their ecosystem; they should be concerned about other similar attacks and about addressing the fears of many users, developers, etc.

Damien Miller (OpenSSH maintainer, OpenBSD committer) has written a patch that implements the relevant libsystemd functionality without libsystemd: https://bugzilla.mindrot.org/show_bug.cgi?id=2641#c13

Reply on news.ycombinator.com