The xz example does not support your case. Not only was every downstream build i... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		goku12 on Dec 9, 2024 \| parent \| context \| favorite \| on: Mise: Dev tools, env vars, task runner The xz example does not support your case. Not only was every downstream build infected until it was discovered, it also needed a distro-specific modification (to openssh in Debian and Fedora, IIRC) to work at all.

Nullabillity on Dec 9, 2024 [–]

The xz backdoor relied on a discrepancy between the development repository and the released (source) artifact.

While skipping the released tarballs wouldn't have prevented the problem entirely, it would have made it much harder to hide.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact