Could the XZ backdoor have been detected with better Git and Debian packaging practices? (optimizedbyotto.com)

submitted 1 month ago by otto@programming.dev to c/security@lemmy.ml

1 comments fedilink hide all child comments

How did the changes in the binary test files tests/files/bad-3-corrupt_lzma2.xz and tests/files/good-large_compressed.lzma, and the makefile change in m4/build-to-host.m4) manifest to the Debian maintainer? Was there a chance of noticing something odd?

top 1 comments

sorted by: hot top controversial new old

[-] adespoton@lemmy.ca 2 points 1 month ago

Well, eventually it WAS noticed before making it to Stable, partly by chance, but partly because of the existing process.

permalink
fedilink
source

this post was submitted on 19 Oct 2025

4 points (100.0% liked)

Security

5753 readers

3 users here now

Confidentiality Integrity Availability

founded 6 years ago

MODERATORS

gary_host_laptop@lemmy.ml