Tired lesbian barely able to do much outside of survive work.
god this is so fucking wild. i strongly recommend giving this entire mailing list post a read without panicking, there's so much going on here.
given the nature of this being a supply chain attack, i am deeply worried that this is going to give strength to the types of people who want to strongly tie identity to software contribution.
holy shit i am so fucking glad i don't work linux distro security anymore
not that it would affect my old job with how far downstream it was but. Good Lord
genuinely impressed how this fell under the radar and only got noted because of a performance issue
bravo
this is wild. the original link seems to be having difficulty but i was able to read it on the internet archive: https://web.archive.org/web/20240329162023/https://www.openwall.com/lists/oss-security/2024/03/29/4
haha i think everyone got got in this case.
noah ~/work [(52163be...) ? +0 ~2 -0 !]
$ xz --version
xz (XZ Utils) 5.6.1
liblzma 5.6.1
[olivia@corvus:~]$ ldd $(which sshd) | grep lzma || echo "not vulnerable"
not vulnerable
just built different, i guess 
my slightly-out-there prediction is that attacks like this are going to be used to justify a push towards proprietary software where the entire stack is known
