XZ Utils backdoor
tukaani.org

They haven’t particularly made a comment on the situation so much as acknowledged it’s happening. They seem to be going with the story that they had nothing to do with it and this is news to them. Hope to hear more from them soon so we can find out more about the situation, how and why this happened, etc.

(The sceptical tone isn’t because of disbelief of Collin, it’s because we don’t know enough about the situation to be able to say Collin is or isn’t telling the truth here.)

  • SteefLem@lemmy.world
    02·
    7 months ago

    Sorry but if the maintainer says it didnt know? Sounds fishy. Or just a bad maintainer.

    • aksdb@lemmy.world
      2·
      7 months ago

      Do you think being maintainer makes you some kind of all knowing being? That’s not how that works. You write code and review code of others.

      If there are multiple maintainers, you may obviously not even notice what another maintainer is doing; then you wouldn’t need multiple maintainers with write access if you could handle it all by yourself.

    • jarfil@lemmy.world
      1·
      7 months ago

      Who’s paying him? Seriously:

      • If nobody is, then we got our value’s worth.
      • If someone is, then we should look at who, how much, and why.
    • RageAgainstTheRich@lemmy.world
      1·
      7 months ago

      I suggest you read a little in how the backdoor was implemented. It wasn’t as obvious as you think. I personally don’t think the owner had anything to do with it.

    • communism@lemmy.mlOP
      1·
      7 months ago

      If I were the co-maintainer of a project I wouldn’t suspect that the person who had been actively contributing for over 2 years had injected malicious code into a binary file to distribute in the tarballs. “Jia Tan” had already gained Collin’s trust by then