Could the XZ backdoor have been detected with better Git and Debian packaging practices? (optimizedbyotto.com)

submitted 10 months ago by otto@programming.dev to c/security@lemmy.ml

1 comments fedilink hide all child comments

How did the changes in the binary test files tests/files/bad-3-corrupt_lzma2.xz and tests/files/good-large_compressed.lzma, and the makefile change in m4/build-to-host.m4) manifest to the Debian maintainer? Was there a chance of noticing something odd?

you are viewing a single comment's thread
view the rest of the comments

[-] adespoton@lemmy.ca 2 points 10 months ago

Well, eventually it WAS noticed before making it to Stable, partly by chance, but partly because of the existing process.

permalink
fedilink
source

this post was submitted on 19 Oct 2025

3 points (100.0% liked)

Security

7026 readers

9 users here now

Confidentiality Integrity Availability

founded 6 years ago

MODERATORS

gary_host_laptop@lemmy.ml