Ariel Millennium Thornton @arielmt@computerfairi.es

Sphinx of black quartz, judge my vows!

The quick brown fox jumps over the lazy dog, but the sphinx of black quartz doesn't judge it notable.

The reply to this is a fair point: downgrade to a pre-5.6.0 version regardless. It's too soon to know if this exploit path is the only one present.

Basically, if you have xz-5.6.0 or xz-5.6.1 installed on Linux, downgrade to an earlier version of xz.

If you use an older version of xz, don't use Linux, or somehow do use Linux *without* systemd, you should be fine.

I love how the xz backdoor hinges on Poettering's Daemon in order to work.

The Register
Headline: "Malicious SSH backdoor sneaks into xz, Linux world's data compression library"
Byline: "Red Hat in all caps says STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES"
https://www.theregister.com/2024/03/29/malicious_backdoor_xz/

@chirpbirb I thought it was a music genre.

@mkb @b0rk The Hubble horizon would be a better analogy, I think: everything within it is theoretically reachable, but everything beyond it to the cosmic event horizon is forever out of reach, even though its light from long ago still had time to reach us.

Every commit in the repo's universe is intrahubble, but somehow y'all found an extrahubble commit.

TIL hard drives can fail while passing all SMART tests, even extended tests.