Reflecting on how the xz backdoor was uncovered because ssh was slow ...
How long would it have taken the ecosystem to notice an aggregate slowdown in SSH on eligible systems?
How do/can distros manage end-to-end testing - to compare performance/behavior to a baseline?
How can we automate additional anomaly detection (commits that contain obfuscation, graph of expected and unexpected component/package interaction, etc.)?
#xz #cve20243094
Royce Williams /
npub1l4…kte68
2024-03-29 20:51:16
Author Public Key
npub1l4uw5jf7geh9gq658wjsga0g4nrez4l28w45yw6n77q238yjgglqykte68Published at
2024-03-29 20:51:16Event JSON
{
"id": "e3b889b9df744f09ecfbf703eaceb8ab0faffe9a78c8f2b9386aaec7accf5311",
"pubkey": "fd78ea493e466e5403543ba50475e8acc79157ea3bab423b53f780a89c92423e",
"created_at": 1711745476,
"kind": 1,
"tags": [
[
"t",
"xz"
],
[
"t",
"cve20243094"
],
[
"proxy",
"https://infosec.exchange/users/tychotithonus/statuses/112180951548660268",
"activitypub"
]
],
"content": "Reflecting on how the xz backdoor was uncovered because ssh was slow ...\n\nHow long would it have taken the ecosystem to notice an aggregate slowdown in SSH on eligible systems?\n\nHow do/can distros manage end-to-end testing - to compare performance/behavior to a baseline?\n\nHow can we automate additional anomaly detection (commits that contain obfuscation, graph of expected and unexpected component/package interaction, etc.)?\n\n#xz #cve20243094",
"sig": "ac5392420fafa780545c799a0260270659d5316a72a235d33ace2a435a3e71ba87a9bc1688fffc71b1148f06bb3172346b8ed8258fb55a09b4feb09790c663de"
}