Debian operating system

3702 readers

1 users here now

Debian is a free operating system (OS) for your computer. An operating system is the set of basic programs and utilities that make your computer run. Debian provides more than a pure OS: it comes with over 59000 packages, precompiled software bundled up in a nice format for easy installation on your machine.

founded 6 years ago

MODERATORS

cydork@lemmy.ml

Could the XZ backdoor have been detected with better Git and Debian packaging practices? (optimizedbyotto.com)

submitted 3 months ago by otto@programming.dev to c/debian@lemmy.ml

2 comments fedilink hide all child comments

How did the changes in the binary test files tests/files/bad-3-corrupt_lzma2.xz and tests/files/good-large_compressed.lzma, and the makefile change in m4/build-to-host.m4) manifest to the Debian maintainer? Was there a chance of noticing something odd?

you are viewing a single comment's thread
view the rest of the comments

[–] moonpiedumplings@programming.dev 5 points 3 months ago* (last edited 3 months ago) (1 children)

Author has some good thoughts, but it's important to mention that the xz backdoor did not make it into debian stable, only sid.

Debian already had policies to handle stuff like this, which is how bookworm wasn't affected.

[–] otto@programming.dev 2 points 3 months ago

There was a bunch of luck involved that Andres Freund detected this. Give more time, it would have ended up in stable releases eventually if not detected.