Arch Linux

7777 readers

1 users here now

The beloved lightweight distro

founded 4 years ago

MODERATORS

[email protected]

369

The xz package has been backdoored, you need to update your system now (archlinux.org)

submitted 8 months ago by [email protected] to c/[email protected]

44 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 12 points 8 months ago (15 children)

Why does xz exist anyway?

[–] [email protected] 21 points 8 months ago* (last edited 8 months ago) (3 children)

It is a compression library that is in the dependency tree for a large number of other packages though not as many as zlib which is in practically everything.

xz development appears to have been compromised by some organisation in a long game targeting sshd in Debian and derivatives. Debian maintainers have a nasty habit of adding lots of patches to upstream sources which occasionally have unintended consequences. I am a long term Debian user but I wish they would stop doing this. Thankfully arch generally doesn't modify upstream as much as Debian and arch sshd doesn't link in the backdoored library.

[–] [email protected] 1 points 8 months ago (2 children)

Ah I see. Are there any reasons why people would choose to use xz over zlib?

[–] Supermariofan67 9 points 8 months ago (1 children)

It compresses much better, by a lot, as zlib/deflate is an ancient algorithm made back when computers only had a few megabytes of ram.

Nowadays though, zstd seems to be replacing both of them, as at max level it compresses about as well as xz while also being faster. Nevertheless, many programs link against all the common compression algorithms (xz/zlib/zstd/bz2) to support everything

[–] [email protected] 2 points 8 months ago

Ah I see

load more comments (11 replies)