Found this in YouTube, although I don't know the technichal details, https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Am 05.04.2024 schrieb Alba Haquitas <alba@nospam.mail>:
Found this in YouTube, although I don't know the technichal details,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Can you give a short report about the content of the video for other
readers, please?
Found this in YouTube, although I don't know the technichal details,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Can you give a short report about the content of the video for other
readers, please?
Marco Moock <mm+usenet@dorfdsl.de> wrote:
Am 05.04.2024 schrieb Alba Haquitas <alba@nospam.mail>:I am not a programmer but an ordinary Linux user, but a trapdoor
Found this in YouTube, although I don't know the technichal details,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Can you give a short report about the content of the video for other
readers, please?
seems to me a root access to the operating system from a remote
location. Here is another YouTube video,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Sorry to be of not much help.
It's just the problem with xz as we were discussing in the German
groups last week.
Marco Moock <mm+usenet@dorfdsl.de> wrote:
Am 05.04.2024 schrieb Alba Haquitas <alba@nospam.mail>:I am not a programmer but an ordinary Linux user, but a trapdoor
Found this in YouTube, although I don't know the technichal details,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Can you give a short report about the content of the video for other
readers, please?
seems to me a root access to the operating system from a remote
location. Here is another YouTube video,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Sorry to be of not much help.
As far as I know the backdoor was introduced to cutting edge systems,
which means sid was affected, but stable branches were not.
On 4/5/24 05:52, Alba Haquitas wrote:
Marco Moock <mm+usenet@dorfdsl.de> wrote:
Am 05.04.2024 schrieb Alba Haquitas <alba@nospam.mail>:I am not a programmer but an ordinary Linux user, but a trapdoor
Found this in YouTube, although I don't know the technichal details,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Can you give a short report about the content of the video for other
readers, please?
seems to me a root access to the operating system from a remote
location. Here is another YouTube video,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Sorry to be of not much help.
Except for academic antio-bug-squads or envelope-pushers (not to confuse
with bureaucratic half-lives) no rational person with a practical
objective would waste time on such enterprise. IF s/he were some
ill-will driven protagonist then s/he was by definition also very
stupid. One of the confidence building pilars of OPEN-SOURCE Linux is
that thousands of benevolent volunteer eyes continuously toil with the
open source code, am I the only one to think that this or similar stunts would seldom survive for long?
badEfA+sector <forgetski@_INVALID.net> writes:
On 4/5/24 05:52, Alba Haquitas wrote:
Marco Moock <mm+usenet@dorfdsl.de> wrote:
Am 05.04.2024 schrieb Alba Haquitas <alba@nospam.mail>:I am not a programmer but an ordinary Linux user, but a trapdoor
Found this in YouTube, although I don't know the technichal details, >>>>> https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Can you give a short report about the content of the video for other
readers, please?
seems to me a root access to the operating system from a remote
location. Here is another YouTube video,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Sorry to be of not much help.
Except for academic antio-bug-squads or envelope-pushers (not to confuse
with bureaucratic half-lives) no rational person with a practical
objective would waste time on such enterprise. IF s/he were some
ill-will driven protagonist then s/he was by definition also very
stupid. One of the confidence building pilars of OPEN-SOURCE Linux is
that thousands of benevolent volunteer eyes continuously toil with the
open source code, am I the only one to think that this or similar stunts
would seldom survive for long?
Maybe not the only one, but certainly one of the few. There are enough examples of problems that survived for more as a decade. That code CAN
be checked does not mean it WILL be checked. There is quit a lot of
code and it is hard to check all code. And sometimes it is also hard
to see the bug.
Even bugs that are not malicious, but are introduced by a wrong understanding, can survive for a long time. For example removing from
a random bit part in SSH key generation because there was a warning of
an undefined value by the compiler slipped through a lot of eyes. And
with generating random keys you need randomness and not
predictability.
On 4/5/24 11:10, Cecil Westerhof wrote:
bad?sector <forgetski@_INVALID.net> writes:
Except for academic antio-bug-squads or envelope-pushers (not to confuse >>> with bureaucratic half-lives) no rational person with a practical
objective would waste time on such enterprise. IF s/he were some
ill-will driven protagonist then s/he was by definition also very
stupid. One of the confidence building pilars of OPEN-SOURCE Linux is
that thousands of benevolent volunteer eyes continuously toil with the
open source code, am I the only one to think that this or similar stunts >>> would seldom survive for long?
Maybe not the only one, but certainly one of the few. There are enough
examples of problems that survived for more as a decade. That code CAN
be checked does not mean it WILL be checked. There is quit a lot of
code and it is hard to check all code. And sometimes it is also hard
to see the bug.
Even bugs that are not malicious, but are introduced by a wrong
understanding, can survive for a long time. For example removing from
a random bit part in SSH key generation because there was a warning of
an undefined value by the compiler slipped through a lot of eyes. And
with generating random keys you need randomness and not
predictability.
I hear you but would you invest energy and time in something that runs
the risk of discovery either two years down the road or the next day?
On 4/5/24 11:10, Cecil Westerhof wrote:
badEfA+sector <forgetski@_INVALID.net> writes:
On 4/5/24 05:52, Alba Haquitas wrote:
Marco Moock <mm+usenet@dorfdsl.de> wrote:
Am 05.04.2024 schrieb Alba Haquitas <alba@nospam.mail>:I am not a programmer but an ordinary Linux user, but a trapdoor
Found this in YouTube, although I don't know the technichal details, >>>>>> https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Can you give a short report about the content of the video for other >>>>> readers, please?
seems to me a root access to the operating system from a remote
location. Here is another YouTube video,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Sorry to be of not much help.
Except for academic antio-bug-squads or envelope-pushers (not to confuse >>> with bureaucratic half-lives) no rational person with a practical
objective would waste time on such enterprise. IF s/he were some
ill-will driven protagonist then s/he was by definition also very
stupid. One of the confidence building pilars of OPEN-SOURCE Linux is
that thousands of benevolent volunteer eyes continuously toil with the
open source code, am I the only one to think that this or similar stunts >>> would seldom survive for long?
Maybe not the only one, but certainly one of the few. There are enough
examples of problems that survived for more as a decade. That code CAN
be checked does not mean it WILL be checked. There is quit a lot of
code and it is hard to check all code. And sometimes it is also hard
to see the bug.
Even bugs that are not malicious, but are introduced by a wrong
understanding, can survive for a long time. For example removing from
a random bit part in SSH key generation because there was a warning of
an undefined value by the compiler slipped through a lot of eyes. And
with generating random keys you need randomness and not
predictability.
I hear you but would you invest energy and time in something that runs
the risk of discovery either two years down the road or the next day? I would not. I'm just saying, with all due respect, given that it's not my field at all. Academic bravado I can buy, the price goes down with
distance from that marker.
bad?sector <forgetski@_invalid.net> wrote:
On 4/5/24 11:10, Cecil Westerhof wrote:
Maybe not the only one, but certainly one of the few. There are enough
examples of problems that survived for more as a decade. That code CAN
be checked does not mean it WILL be checked. There is quit a lot of
code and it is hard to check all code. And sometimes it is also hard
to see the bug.
Even bugs that are not malicious, but are introduced by a wrong
understanding, can survive for a long time. For example removing from
a random bit part in SSH key generation because there was a warning of
an undefined value by the compiler
slipped through a lot of eyes. And with generating random keys you
need randomness and not predictability.
I hear you but would you invest energy and time in something that runs
the risk of discovery either two years down the road or the next day?
Are you arguing here that the backdoor never actually existed
(which it clearly did)? Otherwise clearly someone did take that
risk and given it got into public distro releases (only testing
releases, but many do use those), it potentially did allow them
to hack into real-world systems. So it may have paid off to some
extent before it was discovered, and that discovery was by accident
as well because the backdoor happened to cause performance issues
that an unrelated developer started debugging.
Am 05.04.2024 schrieb Joerg Walther <joerg.walther@magenta.de>:
It's just the problem with xz as we were discussing in the German
groups last week.
That has also been discussed in comp.os.linux.misc.
Marco Moock <mm+usenet@dorfdsl.de> wrote:
Am 05.04.2024 schrieb Joerg Walther <joerg.walther@magenta.de>:I am using Debian-12.1.0-amd64, Linux 6.1.0-18-amd64. How badly it affects the
It's just the problem with xz as we were discussing in the German
groups last week.
That has also been discussed in comp.os.linux.misc.
subject of discussion here, to the Debian version I am using?
Thank you for any comment.
It' is my understanding that Debian 12.1 was not affected. Only Debian >Unstable should have been affected.
On 2024-04-07, badEfA+sector <forgetski@_INVALID.net> wrote:
On 4/5/24 11:10, Cecil Westerhof wrote:
badEfA+sector <forgetski@_INVALID.net> writes:
On 4/5/24 05:52, Alba Haquitas wrote:
Marco Moock <mm+usenet@dorfdsl.de> wrote:
Am 05.04.2024 schrieb Alba Haquitas <alba@nospam.mail>:I am not a programmer but an ordinary Linux user, but a trapdoor
Found this in YouTube, although I don't know the technichal details, >>>>>>> https://www.youtube.com/watch?v=OHAyf0qwdCs
Why nobody is commenting this?
Can you give a short report about the content of the video for other >>>>>> readers, please?
seems to me a root access to the operating system from a remote
location. Here is another YouTube video,
https://www.youtube.com/watch?v=OHAyf0qwdCs
Sorry to be of not much help.
Except for academic antio-bug-squads or envelope-pushers (not to confuse >>>> with bureaucratic half-lives) no rational person with a practical
objective would waste time on such enterprise. IF s/he were some
ill-will driven protagonist then s/he was by definition also very
stupid. One of the confidence building pilars of OPEN-SOURCE Linux is
that thousands of benevolent volunteer eyes continuously toil with the >>>> open source code, am I the only one to think that this or similar stunts >>>> would seldom survive for long?
Maybe not the only one, but certainly one of the few. There are enough
examples of problems that survived for more as a decade. That code CAN
be checked does not mean it WILL be checked. There is quit a lot of
code and it is hard to check all code. And sometimes it is also hard
to see the bug.
Even bugs that are not malicious, but are introduced by a wrong
understanding, can survive for a long time. For example removing from
a random bit part in SSH key generation because there was a warning of
an undefined value by the compiler slipped through a lot of eyes. And
with generating random keys you need randomness and not
predictability.
I hear you but would you invest energy and time in something that runs
the risk of discovery either two years down the road or the next day? I
would not. I'm just saying, with all due respect, given that it's not my
field at all. Academic bravado I can buy, the price goes down with
distance from that marker.
In that case you had better go up and be a hermit. Anything you use
could be bugged, from yout toaster to you favoirite computer program.
And anything you do could be flawed.
And IF this was an attempt by a
state actor to put a backdoor into one of the most used pieces of
software, the risk of discovery was more than offset by the benefit if
it worked even for a while.
If you were given a chance at a billion dollars with a say 90 % chance
of getting nothing would you go for it? I would say that chance of the
discovery of the malware were smaller than 10%, and the prize was
larger than a billion.
Kyonshi <gmkeros@gmail.com> writes:Thank you for your comments. I feel a bit more reassured.
It' is my understanding that Debian 12.1 was not affected. Only Debian >>Unstable should have been affected.
Debian Testing was also affected. But Debian 12.x (i.e., currently
stable) and earlier was not.
- anton
| Sysop: | Amessyroom |
|---|---|
| Location: | Fayetteville, NC |
| Users: | 65 |
| Nodes: | 6 (0 / 6) |
| Uptime: | 01:39:53 |
| Calls: | 862 |
| Files: | 1,311 |
| D/L today: |
10 files (20,373K bytes) |
| Messages: | 264,188 |