Ethan Black @golemwire@librem.one

damn this lzma/xz backdoor is wild

https://www.openwall.com/lists/oss-security/2024/03/29/4

I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates.

Really required a lot of coincidences.

This is the best timeline I've seen so far on what we know about the Xz backdoor. Some good info here for researchers: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

Besides making a sandwich, what's one thing you wish the 'sudo' command could do in real life? #linux #unix

@fribbledom Reaching inbox zero through integer overflow.

And once again, people-finder sites come into play.

"“I pick up the phone and I’m super suspicious,” Patel recalled. “So I ask them if they can verify some information about me, and after hearing some aggressive typing on his end he gives me all this information about me and it’s totally accurate.”

All of it, that is, except his real name. Patel said when he asked the fake Apple support rep to validate the name they had on file for the Apple account, the caller gave a name that was not his but rather one that Patel has only seen in background reports about him that are for sale at a people-search website called PeopleDataLabs."

"If you look for truth, you may find comfort in the end: if you look for comfort you will not get either comfort or truth—only soft soap and wishful thinking to begin with and, in the end, despair." - CS Lewis, Mere Christianity #quotes #CSLewis

@briankrebs I'll just say this in response, personally I never know what is going to offend someone. I have never had great social skills, and when someone takes offense at something I say or do I often agnogize over who was in the wrong, me or the person being (maybe too easily) offended.

That said, if someone has the choice to mute or block me (and they feel they must do one of the two), I'd much rather they block me so I can't read what they write and then maybe at some future point write a response that they will never read. If, as rarely happens, someone offends me so much that I never want to see anything else they might ever write, I'll always choose to block. I do use mute too, but most often because someone is posting in a language other than English but their posts are still getting through despite the fact that I have set my preferences to see English language posts only. Since I only understand English, there is no point in receiving posts from someone who writes in another language.