Hacker News Reader

I have never seen anybody point to it as a security risk before this happened. Would be happy to see a reference of somebody saying that prior to the xz event

View on HN

Report is that shortly before the hole was reported, a PR had been posted requesting to remove the dependency on xz.

Reply on news.ycombinator.com