Sebastian Krzyszkowiak @dos@librem.one

Updates on the xz situation:
https://tukaani.org/xz-backdoor/

https://lore.kernel.org/lkml/20240330144848.102a1e8c@kaneli/

And there's a new commit in the git repo:
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd14dedfe63833f8ccbe41b55823b00

Hey it's totally cool that #microsoft #GitHub blocked access to one of the repositories in the very center of the xz backdoor saga.

It's not like a bunch of people are scrambling to try and make sense of all this right now, or that specific commits got linked to directly from media and blogposts and the like.

Cool, cool.

I know the next 3-7 days will be filled with exaggeration and doomsday talk, but IMHO the #xz backdoor, though seemingly meticulously planned for a long time, failed miserably as it was caught at a stage where it wasn't widely deployed but only in testing/prerelease distros. Yes, it made it quite far in the supply chain but it ultimately failed. The mess is being cleaned up, no cases of actual use of the exploit in the wild are known thus far. The immune system of FOSS has worked. Again.

damn this lzma/xz backdoor is wild

https://www.openwall.com/lists/oss-security/2024/03/29/4

If you feel the leaders of your FOSS projects are insufficiently anti-capitalist or anti-fascist or anti-racist or what have you, you can just ignore them, take the software, and do whatever you want with it, with whomever you please, you don't need anyone's permission

First known symbolic gesture observed in birds; scientists recorded the Japanese tit using repetitive wing movements to signal "after you" to others.

https://www.u-tokyo.ac.jp/focus/en/press/z0508_00339.html?utm_source=join1440&utm_medium=email&utm_placement=newsletter

I'm at an EU workshop for Apple to discuss and justify its DMA compliance plans. They've been forced into 3 huge u-turns by EU (killing PWAs, removing Epic Games' developer licenses, sideloading) so I'm interested to see their demeanour. Will it be humility, or the usual 'fuck you, we're Apple'? There are people from EU companies that Apple blithely planned to bankrupt by sneakily removing PWAs here. And regulators have human feelings too; no-one like "fuck you". I'll be here all day (try the baguettes!)

It always gives me joy when I see that people find useful the /sys/kernel/debug/devices_deferred sysfs entry that I only added to scratch my own itch 🙂

This time in a FOSDEM talk by @a3f about the Linux kernel drivers and devices matching mechanism: https://fosdem.org/2024/schedule/event/fosdem-2024-3222-linux-matchmaking-helping-devices-and-drivers-find-each-other/

#linux #kernel #FOSDEM

With a bit of help from #phoc the next phosh-osk-stub release can (optionally) hide when a keyboard gets attached.

#phosh #LinuxMobile

I was going to try to find the time for an occasional video, and to make an impact (get eyeballs, and people into #MobileLInux, which is the goal, obviously), I thought about putting these on YouTube.

After seeing some negative comments (not directed at me, but at the understaffed, underfunded open-source projects I showcase), I am not sure. F*** these people, seriously.