Re: xz backdoor

To: debian-devel <debian-devel@lists.debian.org>
Subject: Re: xz backdoor
From: Leandro Cunha <leandrocunha016@gmail.com>
Date: Sat, 30 Mar 2024 19:40:19 -0300
Message-id: <[🔎] CAGEayXP8gq_T0n=+iROL2w1n7JpsPkV1gXrDzm5rEM7q6QgKUw@mail.gmail.com>
In-reply-to: <[🔎] 845606FD-868C-4509-A0B1-5B43228CACF7@riseup.net>
References: <[🔎] ZgcgCR8uDPIXVJS_@akarlsso-mac.trudheim.com> <[🔎] 87a5mgkcn4.fsf@hope.eyrie.org> <[🔎] 875xx4k9bv.fsf@hope.eyrie.org> <[🔎] 36567ed4-7246-4466-9122-2934d6e9f18f@debian.org> <[🔎] Zgg3Gm0aGIdQCMua@bongo.bofh.it> <[🔎] 845606FD-868C-4509-A0B1-5B43228CACF7@riseup.net>

Hi,

On Sat, Mar 30, 2024 at 7:00 PM Santiago Ruano Rincón
<santiagorr@riseup.net> wrote:
>
>
>
> Em 30 de março de 2024 13:00:26 GMT-03:00, Marco d'Itri <md@Linux.IT> escreveu:
> >On Mar 30, Jonathan Carter <jcc@debian.org> wrote:
> >
> >> Another big question for me is whether I should really still
> >> package/upload/etc from an unstable machine. It seems that it may be prudent
> >If we do not use unstable for development then who is going to?
> >I think that the real question is whether we should really still use
> >code-signing keys which are not stored in (some kind of) HSM.
> >
>
> The backdoor was discovered by someone using the compromised xz-utils *in their own machines*. So we are lucky we have people eating our own sid stuff before it becomes part of a stable release.
>

You told the truth, sometimes I think it's better to wait a while to
launch very new versions, doing tests beforehand and looking for
problems. But if the person hadn't sent the backdoored version to
unstable, hadn't worried about issues of seconds of performance, in my
opinion it would be quite possible that this would have been in vain
and the person did a great job in mitigating this (I personally I
found very interesting). But on the other hand it caused inconvenience
because I saw in an email here that the processing of the Debian file
is momentarily turned off until it checks what needs to be done.

-- 
Cheers,
Leandro Cunha

Reply to:

References:
- xz backdoor
  - From: Sirius <sirius@trudheim.com>
- Re: xz backdoor
  - From: Russ Allbery <rra@debian.org>
- Re: xz backdoor
  - From: Russ Allbery <rra@debian.org>
- Re: xz backdoor
  - From: Jonathan Carter <jcc@debian.org>
- Re: xz backdoor
  - From: Marco d'Itri <md@Linux.IT>
- Re: xz backdoor
  - From: Santiago Ruano Rincón <santiagorr@riseup.net>

Prev by Date: Re: xz backdoor
Next by Date: Some t64 libraries already in testing; I'm confused
Previous by thread: Re: xz backdoor
Next by thread: Re: xz backdoor
Index(es):
- Date
- Thread