News zx upstream tarball compromises sshd !!!

[Knajjd]

I've know this since day one that upstream could easily add back doors but this shocking exploit will be a wake up call. The only secure method to compute is to isolate hosts from the Internet.

Details here:
https://lwn.net/ml/oss-security/[email protected]/

https://github.com/advisories/GHSA-rxwq-x6h5-x525

Programmer who discovered the exploit was alerted to it by high CPU usage during ssh logins and errors from his debugging tools.

 

[Cryotron]

just install Linux bro

 

[Knajjd]

just install Linux bro

This exploit only targets Linux.

 

[Cryotron]

This exploit only targets Linux.

i was joking

 

[Knajjd]

i was joking

Ah okay, sorry. I'm still in shock from reading about this. All upstream open source can't be trusted. This is bad.

 

[Cryotron]

Ah okay, sorry. I'm still in shock from reading about this. All upstream open source can't be trusted. This is bad.

obviously it can't be trusted, there is millions of lines of code

 

[Knajjd]

obviously it can't be trusted, there is millions of lines of code

True, true but it's a big shock when it happens. And it was sshd that was compromised !

 

[Knajjd]

The maintainer of xz has mental health issues due to burn out from working on the project.

He handed over to the co-maintainer who added the exploit. Now the maintainer is having to deal with a serious crisis along with his mental health issues.

 

[Stupid Clown]

Fuck glowies.