Linux @lemmy.ml testeronious @lemmy.world 11mo ago

XZ Utils is back on GitHub and Lasse Collin has been unbanned

github.com GitHub - tukaani-project/xz: XZ Utils

XZ Utils. Contribute to tukaani-project/xz development by creating an account on GitHub.

58 comments

Commit 77a294d

Update maintainer and author info. The other maintainer suddenly disappeared.

Lmao, that's putting it lightly.
- the other maintainer now has a special place:
  
  Special author: Jia Tan was a co-maintainer in 2022-2024. He and the team behind him inserted a backdoor (CVE-2024-3094) into XZ Utils 5.6.0 and 5.6.1 releases. He suddenly disappeared when this was discovered.
  
  RIP Jia Tan
- - Backdoors are bad for security.
  
  Hmm yes.
  
  The floor is made out of floor
  
  I like how the first point made is that the backdoor violates the Debian Free Software Guidelines, as if that's the main problem
I wonder if he has a donation page. We need to get him some money.
- I agree we should support him, but you know who should be more concerned with giving him and other open source maintainers money? The billion dollar corporations that rely on these critical projects and use them absolutely for free. Amazon, Microsoft, Sony, Samsung, Google, Siemens, Motorola, God knows how many more.
  
  But when open source projects go dual license to try and get paid people lose their minds.
  
  He probably needs a comaintainer. We could select one of us and then try pressuring him into accepting that.
  
  We need more non profits who can set aside funds for these projects. It not like these companies don't want to help its just jot entirely clear how they can help.
  
  I bet Samsung would not even know if open source is a thing
- I wrote to ask him but I never heard back. To be fair he's probably quite stressed at the moment.
Can someone provide a summary on what this means? I thought there were malicious exploits in this. Why is it back up and the perpetrator unbanned?
- Lasse Collin is not the perpetrator, that would be "Jia Tan".
  
  https://tukaani.org/xz-backdoor/
- Lasse is the original maintainer of XZ, they have been placed back in their position as sole maintainer.
  
  "Jia Tan" was the person who slipped the backdoor into XZ and is now banned.
  
  Lasse has already fixed abd removed the backdoor.
  
  XZ itself is critical software everyone uses (its one of the main compression/decompression programs used on linux)
  
  Yes but damage seems to be done. Distros are talking or have moved off of it to zstd.
- Exploits were removed. Maintainer who committed them still banned. xz is a critical piece of software.
- There's a Wikipedia article regarding this incident. Have a look: https://en.wikipedia.org/wiki/XZ_Utils_backdoor
- This sounds just like something Jia Tan might say...
- The second maintainer was most likely the culprit.
- Don't downvote people asking questions.
- https://github.com/tukaani-project/xz/commit/77a294d98a9d2d48f7e4ac273711518bf689f5c4

58 comments