#xz — Public Fediverse posts

Wau how entertaining and exiting way to tell the story of some while back happened XZ vulnerability. Not new, but good watch over the weekend.

"The Internet Was Weeks Away From Disaster and No One Knew"

https://www.youtube.com/watch?v=aoag03mSuXQ

#security #opensource #xz

#XZ Utils 5.8.3: Sicherheitsupdate mit unklarem Risiko | Security https://www.heise.de/news/XZ-Utils-5-8-3-Sicherheitsupdate-mit-unklarem-Risiko-11244419.html #XZutils #Patchday #Linux :tux: #OpenSource

Tää oli kyllä uskomaton tarina miten pienestä joskus voi asiat olla kiinni.

Muistakaa tukea ihmisiä jotka tekevät omalla vapaa-ajallaan ja omaksi ja muiden iloksi asioita. Usein pyyteettömästi. ❤️

https://youtu.be/aoag03mSuXQ

#OpenSSH #XZ #LasseCollin

Great video by @veritasium

https://tube.blueben.net/w/iLGKSpS6yJQWBXxvAMFLAu

#linux #xz #hacking

An excellent video giving strong arguments why every single country should have a @sovtechfund like organization. Or better, an EU agency, in our case.

The Internet Was Weeks Away From Disaster and No One Knew
https://youtu.be/aoag03mSuXQ?si=vbfi9geBAgsj97EF

#OpenSource #DigitalSovereignty #Internet #Sustainability #Linux #GNU #openssh #xz

Veritasium covers the #xz compromise. This is well done. It starts off explaining open source. It explains encryption and compression. It explains software dependencies. It explains how the back door would have worked. Good watch.

#Backdoor #Veritasium #CVE #CVE20243094
https://youtu.be/aoag03mSuXQ

Veritasium made a really good video about the XZ backdoor, with a quick but comprehensive rundown on how it (and therefore partially Linux and libraries as a whole) worked.
#Linux #xz #OpenSource

---

The Internet Was Weeks Away From Disaster and No One Knew - Veritasium
https://www.youtube.com/watch?v=aoag03mSuXQ

The XZ supply chain attack episode from @veritasium

This episode discusses the history, sequence of events and an explanation of the attack along with some speculation as to the threat actor involved.

https://youtu.be/aoag03mSuXQ [52' 59"]

#XZ #SupplyChainAttack #InfoSec #APT

#Veritasium did a video on how #SSH almost became compromised by #XZ, and along the way in a really easy to understand yet precise way explains so many things about the software freedom community that I am truly impressed.

Deserves to be shared widely:

https://www.youtube.com/watch?v=aoag03mSuXQ

The new #Veritasium video about the #XZ vulnerability remains below their usual quality, I regret, although it surely is captivating, at least to a technical audience.

However, I think ordinary viewers might be confused about several aspects, since you need to understand software freedom, the open-source ecosystem and encryption first before the XZ attack can make sense to you, and there wasn't enough time in the video to explain all of it.

:youtube: https://www.youtube.com/watch?v=aoag03mSuXQ

Observation. Although it wasn't the case with older versions of #Debian, or perhaps older versions of #XZ, creating archives with xz on Debian, whether thru tar or xz directly, now uses all CPU cores instead of just one like it did before. Just noticed this after doing a fresh install of Debian 13 a while back on my desktop PC.

#Linux

Seguim amb bona #divulgació sobre l'#opensource. #Veritasium fa aquest fantàstic video que explica per tots els públics pero sense amagar coses com es va arribar a produir i arreglar la vulnerabilitat del #XZ que podría haver afectat a milions d'ordinadors i dispositius #Linux.

Em flipa que ho expliquin tan bé, donant context i fent-ho tan entendible.

https://www.youtube.com/watch?v=aoag03mSuXQ

@rriemann Re: #xz backdoor, you state:

> NixOS: affected and unaffected, slow to roll out updates

But the sources you link don't state that NixOS was vulnerable to exploits, if I'm not mistaken. The backdoored code briefly landed in unstable, but wasn't exploitable due to #NixOS's unique build system. Furthermore, fixing it locally and distributing the fix without relying on the official distro cache/repos is much easier with NixOS, I would argue.

Archivierung und Kompression mit tar: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/archivierung-und-kompression-mit-tar-grundlagen-optionen-und-beispiele/

Kompression mit zip: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-zip-grundlagen-optionen-und-beispiele/

Kompression mit bzip2 Linux: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-bzip2-linux-grundlagen-optionen-und-beispiele/

Kompression mit gzip: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-gzip-grundlagen-optionen-und-beispiele/

Vergleich von Archivierung und Kompression unter Linux: tar/star, gzip, bzip2, xz und zip

https://andreas-moor.de/vergleich-von-archivierung-und-kompression-unter-linux-tar-star-gzip-bzip2-xz-und-zip/

Playing around with compressing a directory structure full of XML files which are about 2MB each (one per directory) and which have a lot of commonality.

It included about 14GB of files in total. With gzip/bzip2/zstd/zip it goes down to ~1GiB (#gzip -> zstd -> bzip2 in order of decreasing size). With #xz it went down to about 67MiB. Huge difference for this use case. Decompressing it was MUCH faster with xz (5.0s vs 33.2s when writing to /dev/null - xz took 5X longer to compress than pigz)

Animated xkcd 2347.

I originally made this after the backdooring attempt of the XZ Utils repo by some entity named Jia Tan was discovered, but without sound. Finally, it is available in stereo, headphones recommended.
Damned, the whole thing was discovered in march 2024! The relevance of this clip might be like a sine wave, hopefully not, but we'll see :P

#b3d #blender3D #npr #xkcd #xkcd2347 #xz #backdoor #infrastructure

Wasn't #Bellingcat doing an entire investigation thing around Jia Tan and the xz stuff.

What happened there?

#JiaTan #XZ

RE: https://infosec.exchange/@joshbressers/115486406615810474

Subscribe to the Open Source Security podcast (opensourcesecurity.io) on your favorite platform and check out the latest episode where I am talking about how I did the #XZ Utils analysis in #Debian.

In light of the #AWS #incident , do y’all remember how the Jia Tan/ #xz exploit was so close to being upstreamed into the AWS Linux.

Think of the blast radius of today’s single datacentre downtime, and magnify it by probably an order of magnitude and you’d realise just how many businesses would now have a backdoor in their VMs

#downtime #cybersecurity #decentralization

Could the XZ backdoor been detected with better Git/Deb packaging practices?

https://optimizedbyotto.com/post/xz-backdoor-debian-git-detection/

#HackerNews #XZ #backdoor #Git #practices #Debian #detection #cybersecurity

🎉 Behold, the groundbreaking revelation: #Xz is not the Holy Grail of data formats! 🚀 Apparently, using xz for digital preservation is like using a sieve as a bucket—bound to fail. Who knew? 🤦‍♂️ Stick to #bzip2, #gzip, or #lzip if you want actual functionality and avoid sinking your data into the abyss of inadequacy. 🔍💾
https://www.nongnu.org/lzip/xz_inadequate.html #dataformats #digitalpreservation #HackerNews #ngated

The new alpm-package #crate offers integration with #ALPM based #package files. 📦 🦀

https://crates.io/crates/alpm-package/0.1.0

Currently it allows to create package files from prepared input directories and supports the #bzip2 #gzip #xz and #zstd #compression algorithms.

#ArchLinux #RustLang #SoftwareRelease

New #blog post: Unix Data Compression Shootout

https://rldane.space/unix-data-compression-shootout.html

881 words

cc: my wonderful #chorus: @joel @dm @sotolf @thedoctor @pixx @twizzay @orbitalmartian @adamsdesk @krafter @roguefoam @clayton @giantspacesquid

(I will happily add/remove you from the chorus upon request! :)

#100DaysToOffload #32

#rlDaneWriting #Unix #Linux #BSD #DataCompression #gzip #bzip #bzip2 #bzip3 #zstd #zst #xz #lz4 #compression

#libarchive 3.7.9 has been released (#MultiFormatArchive / #CompressionLibrary / #FileArchiver / #DataCompression / #7Zip / #7z / #RAR / #ZIP / #GZip / #TAR / #XAR / #WARC / #BZIP2 / #XZ) https://www.libarchive.org/

#XZUtils 5.8.1 (stable) has been released (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression) https://tukaani.org/xz/

#XZUtils 5.8.0 (stable) has been released (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression) https://tukaani.org/xz/

NixOS and reproducible builds could have detected the xz backdoor

https://luj.fr/blog/how-nixos-could-have-detected-xz.html

#HackerNews #NixOS #reproducible #builds #xz #backdoor #security #technews

#XZUtils 5.7.1 Alpha (dev) has been released (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression) https://tukaani.org/xz/

#XZUtils 5.6.4 (stable) has been released (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression) https://tukaani.org/xz/

Tein vähän #pakkaus-kokeiluja törmättyäni taannoin uuteen pakkaimeen, #Bzip3:een. Ainakin minun tiedostojeni #varmuuskopiointi-pakkaamisessa se hävisi pakkausteholtaan selvästi #XZ:lle, jota olen varmuuskopiointiin käyttänyt, ja pakkausnopeudeltaan selvästi #ZStd:lle, johon siirtymistä olin aprikoinut. #atkjuttuja

BZip3

在 Hacker News 上看到 BZip3 的連結：「Bzip3: A spiritual successor to BZip2 (github.com/kspalaiologos)」。

雖然名字看起來與 bzip2 有關，但看起來是不同的人弄出來的東西，不過有些經典的演算法有留下來用，像是 Burrows-Wheeler transform。

另外值得一提的是，bzip2 是 1996 年出的 (不過 1.0 大約是 2000 年時出的)，BZip3 的第一個 release 在 2022 年，這段時間也累積了不少有趣的演算法可以用。

無損壓縮中如果期望有比較的壓縮率，目前比較常用的應該是 LZMA 類的演算法 (差不多是 2001 年出現的)，用的工具通常會是 X

https://blog.gslin.org/archives/2025/02/02/12240/bzip3/

#Computer #Murmuring #Software #bzip2 #bzip3 #compression #lzma #ratio #xz

Advanced threat predictions for 2025 – Source: securelist.com https://ciso2ciso.com/advanced-threat-predictions-for-2025-source-securelist-com/ #Vulnerabilitiesandexploits #KasperskySecurityBulletin #rssfeedpostgeneratorecho #ArtificialIntelligence #APT(Targetedattacks) #CyberSecurityNews #Supplychainattack #internetofthings #machinelearning #Targetedattacks #GoogleAndroid #securelistcom #Triangulation #Hacktivists #deepfakes #AppleiOS #backdoor #botnets #Drivers #BYOVD #APT #XZ

Rilasciato #PeaZip 10.0
https://www.laseroffice.it/blog/2024/10/26/rilasciato-peazip-10-0/

#UnoLinux #compressionedati #7z #zstd #zstandard #gzip #bzip2 #xz #rar #zip #7zip

Finally also available in english.

#fern #ssh #xz #backdoor #JiaTan #CozyBear #APT29 #security

https://www.youtube.com/watch?v=F7iLfuci75Y

#XZUtils 5.6.3 (stable) has been released (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression) https://tukaani.org/xz/

#XZUtils 5.6.2 (stable) has been released (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression / #CVE / #CVE20243094) https://tukaani.org/xz/

#XZUtils 5.4.7 (old stable) has been released (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression) https://tukaani.org/xz/

Was wissen wir eigentlich über «Jia Tan»? Ich habe mich mal auf eine Spurensuche begeben. Und dabei herausgefunden, dass man mit der Sicherheitslücke wohl mehrere Milliarden hätte verdienen können.

Ich nehme euch gerne mit auf diese Reise und die Schlussfolgerungen, die sich daraus ergeben.
#JiaTan #xz #Backdoor #xzBackdoor #DNIP
https://dnip.ch/2024/05/14/spurensuche-jia-tan-xz/

so glad this DIDN'T happen to the #opensource and #linux supply chain with the #xz #backdoor attempt! but it looks way better when things fall over.
what a great excuse to do a #physicssim in #blender3d #b3d after seeing @ahl draw this already. And I learned about drawing outlines in blender, and made things fall over, yay.

#MastoArt #lineart #xkcd #XKCD2347

Also #jiatan in #xz: No need to create a PR, we usually cherry-pick and *edit your commits* preserving you as the author. 😏

https://github.com/tukaani-project/xz/issues/18#issuecomment-1994829182

Lasse Collin in commit message: “The other maintainer suddenly disappeared.” 😆

#jiatan #xz
https://github.com/tukaani-project/xz/commit/77a294d98a9d2d48f7e4ac273711518bf689f5c4

Veckans Kodsnack är här: Vi tar hjälp av Peter Magnusson från Säkerhetspodcasten för attreda ut turerna rkring bakdörren i komprimeringsbiblioteket XZ som upptäcktes under påsken.

Bakdörren var gömd i binärfiler för testfall, byggd för att inte märkas, och allt som behövdes hade smutigts in efter en koordinerad kampanj där upphovspersonerna gavs maintainerbehörighet till XZ.

https://kodsnack.se/578/
#säkerhet #xz #jiatan

#30DaysOfBiking, Day 5, Part 2: Went into the weekend a bit earlier due the time I worked during the Easter weekend on understanding and locally mitigating the #xz f🤬ckup. Ran some cycling related errands: bringing a rain jacket to #Transa for repair and visiting my #Brompton repair shop #Velofix for making an appointment for the next maintenance. The boss came out, pointed to their window and said "You're hanging in our window!" And indeed, there's a printed version of https://www.provelozuerich.ch/magazin/bromptonaut-unter-strom/

I haven't gotten any hate-filled emails for the thing I wrote yesterday which can only mean one thing:

Not
Enough
Hashtags!

https://scottarc.blog/2024/04/04/open-source-supply-chains-and-bears-oh-my/

#xz #backdoor #linux #theskyisfalling #nearmiss #jiatan #opensource #oss #foss #funding #cash #dolla #dolla #bill #yo

Wednesday Links - Edition 2024-04-03
https://dev.to/0xkkocel/wednesday-links-edition-2024-04-03-1hef
#java #jvm #idempotence #junit5 #xz

Regarding the #xz backdoor Jonathan Corbet from https://lwn.net/ thinks that #autoconf is part of the problem: "Why are we still using ancient build systems that almost nobody understands?"
So do I. I have not been using #sendmail for decades which used to have the same #m4 bullshit.