Local moth fairy loves lämp, more at 11 @elfi@pixie.town

I think at a baseline, we shouldn't be building critical official packages for distribution from release tarballs. A huge part of this was the tarball didn't match the repo and since we're talking a compression library, compressed archives shipped for "testing" concealed the payload.

Official builds should pull source and build/test scripts generate testing data in an auditable way rather than just trusting a tarball containing blobs.

Anyway the entire ops/dev world just dodged (we think/hope we dodged, anyway but are not 100% sure) the biggest supply chain attack in history that would have screwed absolutely, literally, everyone.

This needs a giant f**king industry-wide post-mortem once we're sure we're not all doomed.

"Isn't that a bit alarmist?" No!

xz is a base-system package in literally every distro I know of. It's everywhere.

Compromised releases have been out for five weeks and we didn't notice. We only noticed because someone caught openssh taking 10x as long to do DH exchanges and auth. If the attacker had been sneakier we wouldn't have noticed at all.

The compromised xz was in Fedora's testing versions and they didn't notice. You had the compromised version in Arch for a month (and arguably still do, but a combination of build method and source acquisition method likely renders it safe).

If some random guy didn't go "Why is openssh so slow?" and dig really deep into that, it would have hit stable/live distros and then what? We don't know.

These cool system clocks are now available online at https://rmcretro.store/collections/clocks