Technologist vs spy: the xz backdoor debate
lcamtuf.substack.com
Well — we just witnessed one of the most daring infosec capers of my career. Here’s what we know so far: some time ago, an unknown party evidently noticed that liblzma (aka xz) — a relatively obscure open-source compression library — was a dependency of

Thought this was a good read exploring some how the “how and why” including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

  • @speaker_hat
    15•3 months ago

    What if the unexpected SSH latency hadn’t been introduced, this backdoor would live?

    I wonder how many OSS projects include backdoors that doesn’t appear in performance checks

    • @onlinepersona@programming.devEnglish
      3•3 months ago

      What if the unexpected SSH latency won’t be introduced, this backdoor would live?

      I’m confused by this sentence. It uses future tense in the first clause and then conditional in the second. Are you trying to express something that could’ve taken place in the past? Then you should be using “had been”. See conditional sentences.

      What if the unexpected SSH latency hadn’t been introduced, this backdoor would live?

      Or are you trying to express something else?

      CC BY-NC-SA 4.0

      • @speaker_hat
        2•3 months ago

        Thanks, what you wrote is what I meant:

        What if the unexpected SSH latency hadn’t been introduced, this backdoor would live?