• Rustmilian@lemmy.world
    link
    fedilink
    English
    arrow-up
    11
    ·
    edit-2
    7 months ago

    People are still trying to deconstruct this exploit to figure out how the RCE worked.

    True, but we do know how it got into xz in the first place. Human error and bad practice, we wouldn’t have to reverse engineer the exploit if xz didn’t allow binary commits all together. It’s a very convoluted exploit with hiding “junk” and using awk and other commands to cut around that junk and combining it creating a payload and executing it. Our reliance on binary blobs is a double edged sword.

    supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.

    Also true, because human error is impossible to snuff out completely, however it can be reduced if companies donated to the projects they use. For example, Microsoft depends on XZ and doesn’t donate them anything. It’s free as in freedom not cost. Foss devs aren’t suppliers, it comes as is. If you want improvements in the software your massive company relies on, then donate, otherwise don’t expect anything, they aren’t your slaves.

      • 4z01235@lemmy.world
        link
        fedilink
        arrow-up
        18
        ·
        7 months ago

        Generate the binaries during test execution from known (version controlled) inputs, plaintext files and things. Don’t check binaries into source control, especially not intentionally corrupt ones that other maintainers and observers don’t know what they may contain.