Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Bo Anderson <mail () boanderson me>]

> On 30 Mar 2024, at 02:48, Tavis Ormandy <taviso () gmail com> wrote:
>
> Yeah, you're making big decisions for a lot of people here.
>
> If your organization was not on the list and got compromised during the
> embargo, do you think you would be thanking everyone for delaying your
> response?

I think this is a good point to keep in mind.

In this case, I think things were dealt with ok. We believe the main target was deb/rpm builds and those people were 
given some notice about the situation.

However in the wider sense of malware and potentially certain 0-days, it is important to remember distros@ is 
absolutely not the only people that need to know about some of these things.

For example, distros@ excludes package managers on macOS and Windows. To pick out one to demonstrate, xz 5.6.1 on 
Homebrew received over 1.5 million downloads by the time it was pulled (of which at least 20% of that was definitely 
installed). It is very fortunate that we believe the scope was limited to Linux.

And even when you escape the package manager world, there are many people who incorporate these dependencies as a part 
of their own builds. Redistribution of libraries with software (both shared and static) is quite common outside of the 
Linux sphere.

Bo