• carl://@upload.chat
    link
    fedilink
    arrow-up
    52
    ·
    edit-2
    7 months ago

    Arch has already updated XZ by relying on the source code repository itself instead of the tarballs that did have the manipulations in them.

    It’s not ideal since we still rely on a potentially *otherwise* compromised piece of code still but it’s a quick and effective workaround without massive technical trouble for the issue at hand.

    • A_Very_Big_Fan@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      7 months ago

      instead of the tarballs that did have the manipulations in them

      My only exposure to Linux is SteamOS so I might be misunderstanding something, but if not:

      How in the world did it get infected in the first place? Do we know?

      • khannie@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        ·
        7 months ago

        From what I read it was one of the contributors. Looks like they have been contributing for some time too before trying to scooch in this back door. Long con.

      • HopFlop@discuss.tchncs.de
        link
        fedilink
        arrow-up
        4
        ·
        7 months ago

        Basically, one of the contributors that had been contributing for quite some time (and was therefore partly trusted), commited a somewhat hidden backdoor. I doubt it had any effect (as it was discovered now before being pushed to any stable distro and the exploit itself didnt work on Arch) bjt we’ll have to wait for the effect to be analyzed.