486
Commit 77a294d
Update maintainer and author info. The other maintainer suddenly disappeared.
Lmao, that's putting it lightly.
the other maintainer now has a special place:
Special author: Jia Tan was a co-maintainer in 2022-2024. He and the team behind him inserted a backdoor (CVE-2024-3094) into XZ Utils 5.6.0 and 5.6.1 releases. He suddenly disappeared when this was discovered.
RIP Jia Tan
I don't think they would be in much peace. It was years of their work that was ruined by a person with OCD and valgrind.
Can we stop calling a good software dev autistic or stuff?
Hmm yes.
The floor is made out of floor
I like how the first point made is that the backdoor violates the Debian Free Software Guidelines, as if that's the main problem
I wonder if he has a donation page. We need to get him some money.
I agree we should support him, but you know who should be more concerned with giving him and other open source maintainers money? The billion dollar corporations that rely on these critical projects and use them absolutely for free. Amazon, Microsoft, Sony, Samsung, Google, Siemens, Motorola, God knows how many more.
But when open source projects go dual license to try and get paid people lose their minds.
This!!!!
This!!
People, stop celebrating "freeing" software of maintainers that want to prevent being exploited.
Because that's ~~a bad~~ not even a solution.
What about a license that would require every company with a market cap above 25 B that (indirectly) uses the software to contribute X amount (like $1000 a year) of revenue back?
I think if that caught on then companies would call it undue burden to sift through all the dependencies they use to make such small payments.
It is a difficult problem. But on the face of it your suggestion seems very reasonable.
Maybe that force them to just donate to every dependency, probably cheaper on their level. And better for project.
GitHub has a tool built-in to show all dependencies, it's not that hard to write a little script to check the LICENSE files in the repositories. I'm sure one of the biggest companies in the world has the ability to do that.
One of the biggest companies in the world used Copilot to give its users code scraped from GitHub projects without telling them it came from GitHub and that it's under various licenses that need to be followed.
If dual licensing was standard the software that uses things like xz would pay down the line so everything was funded.
I mean this is already a thing to certain degrees right? Virtualization platforms I use both are free for personal use, but not business use, or at least certain feature package use isn't permitted. What's the difference? Putting the software under a different license/eula?
Yes, but the proposed license would also be free for businesses except for the largest in the world.
load more comments
(1 replies)
Seriously. If you're not a business why do you care?
load more comments
(3 replies)
He probably needs a comaintainer. We could select one of us and then try pressuring him into accepting that.
Stop right there, Jio Tan! The same trick doesn't work twice.
We need more non profits who can set aside funds for these projects. It not like these companies don't want to help its just jot entirely clear how they can help.
They can help by donating some of their billions.
Sure. But if the project in question only has one or two donation methods and none of those are supported by the company, then the company can't easily donate anything. Companies usually have a strict way of how they can donate and it usually entails Paypal or some other costly solution, while projects like that likely just has a patreon or LibrePay option and perhaps a crypto wallet. Most companies can't work with that.
load more comments
(1 replies)
load more comments
(3 replies)
I bet Samsung would not even know if open source is a thing
I gotta hand it to Samsung that they outline all the open source licences they use, at least in their Galaxy smartphone products:
As required by the licenses, yes. That's the bare minimum lol.
Samsung is the primary developer for Tizen, a Linux based OS similar to Android. Their watches, cameras, and TVs run it.
load more comments
(2 replies)
I wrote to ask him but I never heard back. To be fair he's probably quite stressed at the moment.
Can someone provide a summary on what this means? I thought there were malicious exploits in this. Why is it back up and the perpetrator unbanned?
Lasse is the original maintainer of XZ, they have been placed back in their position as sole maintainer.
"Jia Tan" was the person who slipped the backdoor into XZ and is now banned.
Lasse has already fixed abd removed the backdoor.
XZ itself is critical software everyone uses (its one of the main compression/decompression programs used on linux)
Yes but damage seems to be done. Distros are talking or have moved off of it to zstd.
There are some, probably. But any exodus will be slow. Xz isn't useless because it was dangerous once.
Besides, XZ isn't the only project in such a danger. Banning doesn't solve that problem. They need to put in more funding and eyes.
Zstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know.
XZ is a slog to compress and decompress but compresses a bit smaller than zstd.
zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format.
I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere
Exploits were removed. Maintainer who committed them still banned. xz is a critical piece of software.
There's a Wikipedia article regarding this incident. Have a look: https://en.wikipedia.org/wiki/XZ_Utils_backdoor
Don't downvote people asking questions.
The second maintainer was most likely the culprit.
This sounds just like something Jia Tan might say...
view more: next ›
this post was submitted on 10 Apr 2024
486 points (100.0% liked)
Linux
56374 readers
452 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS