#xz — Public Fediverse posts

Contd. [en] Software Supply Chain or Software Politics

2/2

"Although no malicious functionality was identified, the case showed how #software #provenance and #governance relationships may create #strategic concerns that are not visible through traditional #technical #analysis." ...

"#AI systems such as #Mythos may transform how governments identify software vulnerabilities, but vulnerabilities are only part of the strategic picture. The lessons of #XZ, #SolarWinds, and easyjson suggest that some of the most consequential risks may not emerge from #vulnerable code, but from the software ecosystem through which code is governed, trusted, and delivered."

https://www.justsecurity.org/142183/hiding-geopolitics-software-supply-chains/

#supplychain #vulnerability #go #easyjson #vk #invasion #ukraine #russia

Contd. [en] Software Supply Chain or Software Politics

2/2

"Although no malicious functionality was identified, the case showed how #software #provenance and #governance relationships may create #strategic concerns that are not visible through traditional #technical #analysis." ...

"#AI systems such as #Mythos may transform how governments identify software vulnerabilities, but vulnerabilities are only part of the strategic picture. The lessons of #XZ, #SolarWinds, and easyjson suggest that some of the most consequential risks may not emerge from #vulnerable code, but from the software ecosystem through which code is governed, trusted, and delivered."

https://www.justsecurity.org/142183/hiding-geopolitics-software-supply-chains/

#supplychain #vulnerability #go #easyjson #vk #invasion #ukraine #russia

[en] Software Supply Chain or Software Politics

1/2

"In 2025, a #software supply chain #vulnerability was discovered in the widely used #Go programming library #easyjson that drew scrutiny due to its association with engineers from the #Russian technology company #VK. The package was hosted on GitHub by a MailRu account, which is owned by VK, and the VK CEO was sanctioned in 2022 by the U.S. Treasury following the Russian #invasion of #Ukraine, due to being or having been a leader or official of the Government of #Russia, amongst other reasons." ...

./2

#supplychain #ai #mythos #xz #solarwinds

[en] Software Supply Chain or Software Politics

1/2

"In 2025, a #software supply chain #vulnerability was discovered in the widely used #Go programming library #easyjson that drew scrutiny due to its association with engineers from the #Russian technology company #VK. The package was hosted on GitHub by a MailRu account, which is owned by VK, and the VK CEO was sanctioned in 2022 by the U.S. Treasury following the Russian #invasion of #Ukraine, due to being or having been a leader or official of the Government of #Russia, amongst other reasons." ...

./2

#supplychain #ai #mythos #xz #solarwinds

Seguim amb bona #divulgació sobre l'#opensource. #Veritasium fa aquest fantàstic video que explica per tots els públics pero sense amagar coses com es va arribar a produir i arreglar la vulnerabilitat del #XZ que podría haver afectat a milions d'ordinadors i dispositius #Linux.

Em flipa que ho expliquin tan bé, donant context i fent-ho tan entendible.

https://www.youtube.com/watch?v=aoag03mSuXQ

Seguim amb bona #divulgació sobre l'#opensource. #Veritasium fa aquest fantàstic video que explica per tots els públics pero sense amagar coses com es va arribar a produir i arreglar la vulnerabilitat del #XZ que podría haver afectat a milions d'ordinadors i dispositius #Linux.

Em flipa que ho expliquin tan bé, donant context i fent-ho tan entendible.

https://www.youtube.com/watch?v=aoag03mSuXQ

Archivierung und Kompression mit tar: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/archivierung-und-kompression-mit-tar-grundlagen-optionen-und-beispiele/

Archivierung und Kompression mit tar: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/archivierung-und-kompression-mit-tar-grundlagen-optionen-und-beispiele/

Archivierung und Kompression mit tar: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/archivierung-und-kompression-mit-tar-grundlagen-optionen-und-beispiele/

Kompression mit zip: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-zip-grundlagen-optionen-und-beispiele/

Kompression mit zip: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-zip-grundlagen-optionen-und-beispiele/

Kompression mit zip: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-zip-grundlagen-optionen-und-beispiele/

Kompression mit bzip2 Linux: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-bzip2-linux-grundlagen-optionen-und-beispiele/

Kompression mit bzip2 Linux: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-bzip2-linux-grundlagen-optionen-und-beispiele/

Kompression mit bzip2 Linux: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-bzip2-linux-grundlagen-optionen-und-beispiele/

Kompression mit gzip: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-gzip-grundlagen-optionen-und-beispiele/

Kompression mit gzip: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-gzip-grundlagen-optionen-und-beispiele/

Kompression mit gzip: Grundlagen, Optionen und Beispiele

https://andreas-moor.de/kompression-mit-gzip-grundlagen-optionen-und-beispiele/

Vergleich von Archivierung und Kompression unter Linux: tar/star, gzip, bzip2, xz und zip

https://andreas-moor.de/vergleich-von-archivierung-und-kompression-unter-linux-tar-star-gzip-bzip2-xz-und-zip/

Vergleich von Archivierung und Kompression unter Linux: tar/star, gzip, bzip2, xz und zip

https://andreas-moor.de/vergleich-von-archivierung-und-kompression-unter-linux-tar-star-gzip-bzip2-xz-und-zip/

Vergleich von Archivierung und Kompression unter Linux: tar/star, gzip, bzip2, xz und zip

https://andreas-moor.de/vergleich-von-archivierung-und-kompression-unter-linux-tar-star-gzip-bzip2-xz-und-zip/

🎉 Behold, the groundbreaking revelation: #Xz is not the Holy Grail of data formats! 🚀 Apparently, using xz for digital preservation is like using a sieve as a bucket—bound to fail. Who knew? 🤦‍♂️ Stick to #bzip2, #gzip, or #lzip if you want actual functionality and avoid sinking your data into the abyss of inadequacy. 🔍💾
https://www.nongnu.org/lzip/xz_inadequate.html #dataformats #digitalpreservation #HackerNews #ngated

🎉 Behold, the groundbreaking revelation: #Xz is not the Holy Grail of data formats! 🚀 Apparently, using xz for digital preservation is like using a sieve as a bucket—bound to fail. Who knew? 🤦‍♂️ Stick to #bzip2, #gzip, or #lzip if you want actual functionality and avoid sinking your data into the abyss of inadequacy. 🔍💾
https://www.nongnu.org/lzip/xz_inadequate.html #dataformats #digitalpreservation #HackerNews #ngated

🎉 Behold, the groundbreaking revelation: #Xz is not the Holy Grail of data formats! 🚀 Apparently, using xz for digital preservation is like using a sieve as a bucket—bound to fail. Who knew? 🤦‍♂️ Stick to #bzip2, #gzip, or #lzip if you want actual functionality and avoid sinking your data into the abyss of inadequacy. 🔍💾
https://www.nongnu.org/lzip/xz_inadequate.html #dataformats #digitalpreservation #HackerNews #ngated

🎉 Behold, the groundbreaking revelation: #Xz is not the Holy Grail of data formats! 🚀 Apparently, using xz for digital preservation is like using a sieve as a bucket—bound to fail. Who knew? 🤦‍♂️ Stick to #bzip2, #gzip, or #lzip if you want actual functionality and avoid sinking your data into the abyss of inadequacy. 🔍💾
https://www.nongnu.org/lzip/xz_inadequate.html #dataformats #digitalpreservation #HackerNews #ngated

New #blog post: Unix Data Compression Shootout

https://rldane.space/unix-data-compression-shootout.html

881 words

cc: my wonderful #chorus: @joel @dm @sotolf @thedoctor @pixx @twizzay @orbitalmartian @adamsdesk @krafter @roguefoam @clayton @giantspacesquid

(I will happily add/remove you from the chorus upon request! :)

#100DaysToOffload #32

#rlDaneWriting #Unix #Linux #BSD #DataCompression #gzip #bzip #bzip2 #bzip3 #zstd #zst #xz #lz4 #compression

New #blog post: Unix Data Compression Shootout

https://rldane.space/unix-data-compression-shootout.html

881 words

cc: my wonderful #chorus: @joel @dm @sotolf @thedoctor @pixx @twizzay @orbitalmartian @adamsdesk @krafter @roguefoam @clayton @giantspacesquid

(I will happily add/remove you from the chorus upon request! :)

#100DaysToOffload #32

#rlDaneWriting #Unix #Linux #BSD #DataCompression #gzip #bzip #bzip2 #bzip3 #zstd #zst #xz #lz4 #compression

#libarchive 3.7.9 has been released (#MultiFormatArchive / #CompressionLibrary / #FileArchiver / #DataCompression / #7Zip / #7z / #RAR / #ZIP / #GZip / #TAR / #XAR / #WARC / #BZIP2 / #XZ) https://www.libarchive.org/

#libarchive 3.7.9 has been released (#MultiFormatArchive / #CompressionLibrary / #FileArchiver / #DataCompression / #7Zip / #7z / #RAR / #ZIP / #GZip / #TAR / #XAR / #WARC / #BZIP2 / #XZ) https://www.libarchive.org/

Tein vähän #pakkaus-kokeiluja törmättyäni taannoin uuteen pakkaimeen, #Bzip3:een. Ainakin minun tiedostojeni #varmuuskopiointi-pakkaamisessa se hävisi pakkausteholtaan selvästi #XZ:lle, jota olen varmuuskopiointiin käyttänyt, ja pakkausnopeudeltaan selvästi #ZStd:lle, johon siirtymistä olin aprikoinut. #atkjuttuja

Tein vähän #pakkaus-kokeiluja törmättyäni taannoin uuteen pakkaimeen, #Bzip3:een. Ainakin minun tiedostojeni #varmuuskopiointi-pakkaamisessa se hävisi pakkausteholtaan selvästi #XZ:lle, jota olen varmuuskopiointiin käyttänyt, ja pakkausnopeudeltaan selvästi #ZStd:lle, johon siirtymistä olin aprikoinut. #atkjuttuja

BZip3

在 Hacker News 上看到 BZip3 的連結：「Bzip3: A spiritual successor to BZip2 (github.com/kspalaiologos)」。

雖然名字看起來與 bzip2 有關，但看起來是不同的人弄出來的東西，不過有些經典的演算法有留下來用，像是 Burrows-Wheeler transform。

另外值得一提的是，bzip2 是 1996 年出的 (不過 1.0 大約是 2000 年時出的)，BZip3 的第一個 release 在 2022 年，這段時間也累積了不少有趣的演算法可以用。

無損壓縮中如果期望有比較的壓縮率，目前比較常用的應該是 LZMA 類的演算法 (差不多是 2001 年出現的)，用的工具通常會是 X

https://blog.gslin.org/archives/2025/02/02/12240/bzip3/

#Computer #Murmuring #Software #bzip2 #bzip3 #compression #lzma #ratio #xz

BZip3

在 Hacker News 上看到 BZip3 的連結：「Bzip3: A spiritual successor to BZip2 (github.com/kspalaiologos)」。

雖然名字看起來與 bzip2 有關，但看起來是不同的人弄出來的東西，不過有些經典的演算法有留下來用，像是 Burrows-Wheeler transform。

另外值得一提的是，bzip2 是 1996 年出的 (不過 1.0 大約是 2000 年時出的)，BZip3 的第一個 release 在 2022 年，這段時間也累積了不少有趣的演算法可以用。

無損壓縮中如果期望有比較的壓縮率，目前比較常用的應該是 LZMA 類的演算法 (差不多是 2001 年出現的)，用的工具通常會是 X

https://blog.gslin.org/archives/2025/02/02/12240/bzip3/

#Computer #Murmuring #Software #bzip2 #bzip3 #compression #lzma #ratio #xz

How to make #opensource #software more secure
The #xz attack, which followed other well-known cybersecurity incidents involving open source software like #Heartbleed, #Shellshock, and #Log4j, was another stark reminder that open source software, given how widespread it is, can pose significant #security risks.  
https://techcrunch.com/2024/11/01/how-to-make-open-source-software-more-secure/ #itsec

How to make #opensource #software more secure
The #xz attack, which followed other well-known cybersecurity incidents involving open source software like #Heartbleed, #Shellshock, and #Log4j, was another stark reminder that open source software, given how widespread it is, can pose significant #security risks.  
https://techcrunch.com/2024/11/01/how-to-make-open-source-software-more-secure/ #itsec

How to make #opensource #software more secure
The #xz attack, which followed other well-known cybersecurity incidents involving open source software like #Heartbleed, #Shellshock, and #Log4j, was another stark reminder that open source software, given how widespread it is, can pose significant #security risks.  
https://techcrunch.com/2024/11/01/how-to-make-open-source-software-more-secure/ #itsec

How to make #opensource #software more secure
The #xz attack, which followed other well-known cybersecurity incidents involving open source software like #Heartbleed, #Shellshock, and #Log4j, was another stark reminder that open source software, given how widespread it is, can pose significant #security risks.  
https://techcrunch.com/2024/11/01/how-to-make-open-source-software-more-secure/ #itsec

How to make #opensource #software more secure
The #xz attack, which followed other well-known cybersecurity incidents involving open source software like #Heartbleed, #Shellshock, and #Log4j, was another stark reminder that open source software, given how widespread it is, can pose significant #security risks.  
https://techcrunch.com/2024/11/01/how-to-make-open-source-software-more-secure/ #itsec

Finally also available in english.

#fern #ssh #xz #backdoor #JiaTan #CozyBear #APT29 #security

https://www.youtube.com/watch?v=F7iLfuci75Y

Finally also available in english.

#fern #ssh #xz #backdoor #JiaTan #CozyBear #APT29 #security

https://www.youtube.com/watch?v=F7iLfuci75Y

I deeply respect @briankrebs, but in this case I think the data he's presenting is fundamentally invalid. A little-known fact about #Git history is that #timestamps are both definable and mutable. While you might be able to make statements about when a Git commit was pushed to a server using the server-side SSH or HTTP logs, the fact that you can set GIT_AUTHOR_DATE and GIT_COMMITTER_DATE as environment variables means you can't rely on commit timestamps alone for this type of analysis.

This is a feature of Git since the ability to squash or rewrite its mutable history is a key differentiator compared to #FossilSCM or other #SCMs that treat history as immutable(ish). For example, allowing one to do things like report a commit as the time a patch or source document was originally written rather than just noting when it was committed or merged can be very useful in accurately representing the real-world evolution of data created outside the repository.

This is not a flaw in Git. Anyone savvy enough to craft the #xz attack could just as easily have adjusted their system clocks instead, leading to fraudulent timestamps in the commit history anyway.

Forensically, you'd need to look at the timestamps from NTP-backed server or router logs, not just the Git history. All Git clients are technically "offline" until they push one or more commits to a remote, so there's really no way to validate client-side SCM timestamps. This is also true of email headers, filesystem attributes, and any other data that relies on real system clocks or user-defined timestamps, so you'd need more points of correlation than are provided here.

https://www.linkedin.com/posts/bkrebs_one-of-the-more-interesting-graphics-ive-activity-7181358250112471040-fzeG

I deeply respect @briankrebs, but in this case I think the data he's presenting is fundamentally invalid. A little-known fact about #Git history is that #timestamps are both definable and mutable. While you might be able to make statements about when a Git commit was pushed to a server using the server-side SSH or HTTP logs, the fact that you can set GIT_AUTHOR_DATE and GIT_COMMITTER_DATE as environment variables means you can't rely on commit timestamps alone for this type of analysis.

This is a feature of Git since the ability to squash or rewrite its mutable history is a key differentiator compared to #FossilSCM or other #SCMs that treat history as immutable(ish). For example, allowing one to do things like report a commit as the time a patch or source document was originally written rather than just noting when it was committed or merged can be very useful in accurately representing the real-world evolution of data created outside the repository.

This is not a flaw in Git. Anyone savvy enough to craft the #xz attack could just as easily have adjusted their system clocks instead, leading to fraudulent timestamps in the commit history anyway.

Forensically, you'd need to look at the timestamps from NTP-backed server or router logs, not just the Git history. All Git clients are technically "offline" until they push one or more commits to a remote, so there's really no way to validate client-side SCM timestamps. This is also true of email headers, filesystem attributes, and any other data that relies on real system clocks or user-defined timestamps, so you'd need more points of correlation than are provided here.

https://www.linkedin.com/posts/bkrebs_one-of-the-more-interesting-graphics-ive-activity-7181358250112471040-fzeG

Do you remember when AT&T rolled back the ksh repository to a version 8 years old dismissing all the changes made in the last years by contributors?
Maybe we can do the same with the last two years of xz-utils?

#xz #XZBackdoor #JiaTan #JiaT75 #JustJoking

@chris @shansterable

The #xz #backdoor insertion was a result of a coordinated social engineering attack

From the emails:

As I have hinted in earlier emails, #Jia #Tan may have a bigger role in the project in the future. He has been helping a lot off-list and is practically a co-maintainer already. :-) I know that not much has happened in the git repository yet but things happen in small steps.
In any case some change in maintainership is already in progress at least
for XZ Utils.

--
#Lasse #Collin

https://www.mail-archive.com/xz-devel@tukaani.org/msg00571.html

@chris @shansterable

The #xz #backdoor insertion was a result of a coordinated social engineering attack

From the emails:

As I have hinted in earlier emails, #Jia #Tan may have a bigger role in the project in the future. He has been helping a lot off-list and is practically a co-maintainer already. :-) I know that not much has happened in the git repository yet but things happen in small steps.
In any case some change in maintainership is already in progress at least
for XZ Utils.

--
#Lasse #Collin

https://www.mail-archive.com/xz-devel@tukaani.org/msg00571.html