tukaani-project/xz on Hacker News

…seems fine to me. The maintainers are doing the latter, I’d say this is a good response. [1]: https://github.com/tukaani-project/xz/issues/121

comment by thih9 · 2024-05-19 · in Ask HN: Why are people so mean in the open source community? (about xz again)

…fairness, Jia was indeed the co-maintainer of the project. He modified SECURITY.md as well[1]. [1] https://github.com/tukaani-project/xz/commit/780d2c236de0e47...

comment by johnisgood · 2024-04-13 · in XZ backdoor story – Initial analysis

Very funny. This one: https://github.com/tukaani-project/xz/commits?author=thesame... https://github.com/thesamesam Seems like he's a Gentoo contributor.

comment by asveikau · 2024-04-13 · in XZ backdoor story – Initial analysis

…code's extension hooks. This is done with what should have been a highly suspicious commit: https://github.com/tukaani-project/xz/commit/6e636819e8f0703... - this replaces "random" test files with other "random" test files. The state reson…

comment by account42 · 2024-04-11 · in The xz sshd backdoor rabbithole goes quite a bit deeper

https://github.com/tukaani-project/xz/commit/77a294d98a9d2d4... Special author: Jia Tan was a co-maintainer in 2022-2024. He and the team behind him inserted a backdoor (CVE-2024-3094) into XZ Utils 5.6.0 and 5.6.1 releases. He suddenly…

comment by glandium · 2024-04-10 · in The xz-utils backdoor has been removed

https://github.com/tukaani-project/xz/commit/780cbf29d5a88db... to update the NEWS file is equally honest: 5.6.1 (2024-03-09) IMPORTANT: This fixed bugs in the backdoor (CVE-2024-3094) (someone had forgot to run Valgrind).

comment by syntheticcdo · 2024-04-10 · in The xz-utils backdoor has been removed

This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92... While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was…

comment by rgovostes · 2024-04-10 · in The xz-utils backdoor has been removed

The security policy was also updated: https://github.com/tukaani-project/xz/commit/780d2c236de0e47...

comment by EveryPizza · 2024-04-09 · in The xz-utils backdoor has been removed

Internet Archive to the rescue! It's still possible to download the liblzma source code from the Internet Archive's Github snapshot of the 5.4.6 stable release: https://web.archive.org/web/20240329182145/https://github.co...

comment by mttpgn · 2024-04-05 · in FFmpeg 7.0

In https://archive.softwareheritage.org/browse/revision/e446ab7... one can open the patches and then click the "Changes" sub-tab. Stuff like this looks like a perf improvement but who knows if a tricky bug is introduced that was aimed to…

comment by goombacloud · 2024-04-02 · in Timeline of the xz open source attack

Hello everybody. I am taking the initiative to gather more information regarding the possible precursors and perpetrators of the backdoor. The purpose of this commentary is focused on open source information (OSINT). I am not a judge of…

comment by krascovict · 2024-03-31 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

Now the GitHub repo has been disabled by GitHub due to violation of GitHub's terms. https://github.com/tukaani-project/xz

comment by marco_patino · 2024-03-31 · in Xz/liblzma: Bash-stage Obfuscation Explained

Update: found a repo(thanks to @ar-jan on GitHub), https://archive.softwareheritage.org/browse/origin/directory...

comment by AverseABFun · 2024-03-30 · in GitHub Disabled the Xz Repo

Apparently there's a wayback machine for git repos and it "just coincidentally" archived this repo the day before the news broke: https://archive.softwareheritage.org/browse/origin/visits/?o...

comment by gpm · 2024-03-30 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

The answer is not complete. There were 2 ways to pull sources: bad - https://github.com/tukaani-project/xz/releases/download/ ... or: good - https://github.com/tukaani-project/xz/archive/refs/tags/ ... Specifically in Gentoo, there is a…

comment by Lockal · 2024-03-30 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

You're right, but maybe because there's nothing to see : https://github.com/tukaani-project/xz

comment by az09mugen · 2024-03-30 · in GitHub Disabled the Xz Repo

Hello, Github just disabled the repo : https://github.com/tukaani-project/xz Do someone have an up to date fork to see the project history ?

comment by Dribble4633 · 2024-03-30 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…> tests/files/good-large_compressed.lzma > committed upstream. They were initially added in > https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf...

comment by gamer191 · 2024-03-30 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

It's not a problem, never has been. Nix mirrors all source bundles it pulls from third parties and caches them. cache.nixos.org has a copy of all the sources needed to build not just current HEAD, but also past commits (although deep…

comment by dave_universetf · 2024-03-30 · in GitHub Disabled the Xz Repo

…issue pretty difficult, when GitHub has revoked everyone's access to see the affected source code. https://github.com/tukaani-project/xz vs https://github.com/JiaT75

comment by CGamesPlay · 2024-03-30 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

Interestingly: https://github.com/tukaani-project/xz/issues/62#issuecomment...

comment by afh1 · 2024-03-30 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…timezone. Below are links to the git mailbox files where you could see the timezone. From 2022: - https://github.com/tukaani-project/xz/commit/c6977e740008817... - https://github.com/tukaani-project/xz/commit/7c16e312cb2f40b... From 2024:…

comment by rany_ · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…is tagged `upstream/v5.6.0` despite the script itself not being present on that tag upstream: https://github.com/tukaani-project/xz/tree/v5.6.0/m4 > I'm also suggesting that there could be more than one exploit present. All of their…

comment by cassianoleal · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…binary needed to be modified for the exploit to work[1] which was later picked up by build system. https://github.com/tukaani-project/xz/commit/6e636819e8f0703...

comment by YetAnotherNick · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

That was a review of someone else's work? https://github.com/tukaani-project/xz/pull/86

comment by rrix2 · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

Also I see this PR: https://github.com/tukaani-project/xz/pull/64

comment by zb3 · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…report by emailing us at [xz@tukaani.org](mailto:xz@tukaani.org), or through [Security Advisories](https://github.com/tukaani-project/xz/security/advisories/new). -While both options are available, we prefer email. In any case, please…

comment by pja · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…is "authored by" Lasse Collin in the git metadata, but the code actually came from Hans Jansen: https://github.com/tukaani-project/xz/commit/ee44863ae88e377... > Thanks to Hans Jansen for the original patch.…

comment by formerly_proven · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

> "Docs: Simplify SECURITY.md." https://github.com/tukaani-project/xz/commit/af071ef7702debe... Removes instructions about details relevant to security reports. Heh, nice one.

comment by 20after4 · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…is weirdly a simplification of the security reporting process, to not request as much detail: https://github.com/tukaani-project/xz/commit/af071ef7702debe... Not sure what to make of this.

comment by colanderman · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…git repo is "Simplify SECURITY.md", committed by the same Github account which added the backdoor. https://github.com/tukaani-project/xz/commit/af071ef7702debe...

comment by formerly_proven · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…ifuncs and inlining (all at the same time): https://bugzilla.redhat.com/show_bug.cgi?id=2267598 https://github.com/tukaani-project/xz/commit/82ecc538193b380...

comment by rwmj · 2024-03-17 · in The return of the frame pointers