Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Marcin Wolcendorf <antymat () chelmska waw pl>]

On Sat, Mar 30, 2024 at 09:34:45AM -0400, Marc Deslauriers wrote:
> On 2024-03-29 22:48, Tavis Ormandy wrote:
> > On 2024-03-30, Marc Deslauriers wrote:
> >
> > Sure - but why do you have to do that in private? You can get everyone
> > to help get those answers and converge on the correct solution
> > quickly.
> >
> > The attackers already knew about this issue, so you were just keeping it
> > from defenders... that doesn't make sense to me.
>
> I'll let you in on a little secret: malicious entities also read this list.
>
> There is no way to discuss this in public without turning a single malicious
> entity into 10 000 malicious entities once the information is widely known.
>
> Making sure the impact and mitigations are known before posting this
> publicly so that everyone knows what to do before the 10 000 malicious
> entities start attacking is just common sense.

I'll let you in on a little secret, too: bad actors talk to each other! They
exchange information about the exploits. So you already *potentially have* 
10000 of them trying to exploit the vulnerability, with the most of the
affected people being none-the-wiser. 

I'd rather know, so I can do something to avoid or repair the damage, instead
of figuring out my systems might have been compromised for weeks. If you want
to sit in the dark - feel free, just don't take me with you. 
 
M.

-- 
    *** System shutdown message from root ***

System going down in 60 seconds