Record · corpus.blog/posts/01a0877c-4f7d-709c-90ad-c4fe6395cebc

Thoughts on the xz backdoor: an lzma-rs perspective

gendignoux.com · published 8 April 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at gendignoux.com Wayback capture

1blogs citing

First cited: 31 Mar 2024
Most recent: 31 Mar 2024
Rank this month: not ranked
Links from this post: 99
Words captured: 3,246

Cited by

Blog

In the post

Date

Shellsharks

xz/liblzma Compromise Link Roundup Read at the source ↗

31 Mar 2024

Links from this post

Link

Host

Sudo-rs dependencies: when less is better Read at the source ↗

memorysafety.org

https://lucumr.pocoo.org/2024/3/26/rust-cdo/

lucumr.pocoo.org

https://www.openwall.com/lists/oss-security/2024/03/29/4

openwall.com

https://github.com/gendx/lzma-rs

github.com

https://prev.rust-lang.org

prev.rust-lang.org

https://lib.rs/crates/lzma-rs

lib.rs

https://crates.io/crates/lzma-rs

crates.io

https://lib.rs/crates/lzma-rs/rev

lib.rs

https://github.com/gendx/lzma-rs/blob/master/CHANGELOG.md

github.com

https://github.com/gendx/lzma-rs/pull/61

github.com

https://github.com/gendx/lzma-rs/pull/59

github.com

https://github.com/gendx/lzma-rs/pull/101

github.com

https://github.com/gendx/lzma-rs/issues/9

github.com

https://github.com/gendx/lzma-rs/blob/master/tests/files/range-coder-edge-case.lzma

github.com

https://github.com/gendx/lzma-rs/pull/16

github.com

https://github.com/gendx/lzma-rs/blob/v0.3.0/Cargo.toml

github.com

https://github.com/gendx/lzma-rs/blob/master/Cargo.toml

github.com

https://rustsec.org/

rustsec.org

https://en.wikipedia.org/wiki/Sock_puppet_account

en.wikipedia.org

https://github.com/rustsec/advisory-db/blob/main/HOWTO_UNMAINTAINED.md

github.com

https://crates.io/policies

crates.io

https://lib.rs/crates/xz2

lib.rs

https://lib.rs/crates/lzma-sys

lib.rs

https://github.com/rust-lang/rust/blob/1.77.1/src/bootstrap/Cargo.toml

github.com

https://github.com/rust-lang/rust/blob/1.77.1/src/bootstrap/src/core/download.rs

github.com

https://github.com/alexcrichton/xz2-rs/tree/main/lzma-sys

github.com

https://github.com/xz-mirror/xz/tree/2327a461e1afce862c22269b80d3517801103c1b

github.com

https://docs.rs/crate/lzma-sys/latest/source/

docs.rs

https://github.com/alexcrichton/xz2-rs/pull/103/files

github.com

https://github.com/alexcrichton/xz2-rs/blob/main/lzma-sys/build.rs

github.com

https://git.tukaani.org/?p=xz.git;a=blob;f=CMakeLists.txt

git.tukaani.org

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2bbb81307644efdb58db2c422d9ba7

git.tukaani.org

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd14dedfe63833f8ccbe41b55823b00

git.tukaani.org

https://git.tukaani.org/?p=xz.git;a=blob;f=configure.ac

git.tukaani.org

https://git.tukaani.org/?p=xz.git;a=tree;f=cmake

git.tukaani.org

https://git.tukaani.org/?p=xz.git;a=tree;f=m4

git.tukaani.org

https://salsa.debian.org/debian/xz-utils/-/blob/debian/5.6.0-0.2/m4/build-to-host.m4

salsa.debian.org

https://cmake.org/cmake/help/latest/module/CheckCSourceCompiles.html

cmake.org

https://github.com/pyca/cryptography/issues/5771

github.com

https://doc.rust-lang.org/nightly/rustc/platform-support.html

doc.rust-lang.org

https://doc.rust-lang.org/cargo/reference/build-scripts.html

doc.rust-lang.org

https://doc.rust-lang.org/cargo/reference/manifest.html

doc.rust-lang.org

https://doc.rust-lang.org/reference/conditional-compilation.html

doc.rust-lang.org

https://packages.debian.org/stable/gzip

packages.debian.org

https://packages.debian.org/stable/bzip2

packages.debian.org

https://packages.debian.org/stable/xz-utils

packages.debian.org

https://github.com/coreutils/coreutils

github.com

https://www.sovereigntechfund.de/news/xz-systemic-issues

sovereigntechfund.de

https://www.sovereigntechfund.de/tech

sovereigntechfund.de

https://github.com/uutils/coreutils

github.com

https://github.com/RustCrypto

github.com

https://rustsec.org/advisories/RUSTSEC-2023-0071.html

rustsec.org

https://rust-lang.github.io/rfcs/3243-packages-as-optional-namespaces.html

rust-lang.github.io

https://github.com/libarchive/libarchive

github.com

https://github.com/libarchive/libarchive/pull/1609

github.com

https://github.com/rust-lang/hashbrown

github.com

https://github.com/rust-lang

github.com

https://lcamtuf.substack.com/p/oss-backdoors-the-allure-of-the-easy

lcamtuf.substack.com

Detecting SIMD support on ARM with Android (and patching the Rust compiler for it) Read at the source ↗

gendignoux.com

https://gendignoux.com/blog/images/rust-simd-detect-arm-android/cargo-timing-1cpu-rustc.html

gendignoux.com

https://github.com/rust-lang/cargo

github.com

https://lib.rs/crates/cargo-audit

lib.rs

https://crates.io/users/alexcrichton

crates.io

https://internals.rust-lang.org/t/scaling-back-my-involvement-in-rust/11754

internals.rust-lang.org

https://mikemcquaid.com/open-source-maintainers-owe-you-nothing/

mikemcquaid.com

https://csrc.nist.gov/projects/post-quantum-cryptography

csrc.nist.gov

https://project-everest.github.io/

project-everest.github.io

https://tls13tamarin.github.io/TLS13Tamarin/

tls13tamarin.github.io

https://eprint.iacr.org/2016/081

eprint.iacr.org

https://arstechnica.com/security/2024/03/hackers-can-extract-secret-encryption-keys-from-apples-mac-chips/

arstechnica.com

https://gofetch.fail/

gofetch.fail

https://en.wikipedia.org/wiki/CRIME

en.wikipedia.org

https://en.wikipedia.org/wiki/Transport_Layer_Security

en.wikipedia.org

https://en.wikipedia.org/wiki/BREACH

en.wikipedia.org

https://en.wikipedia.org/wiki/Deb_(file_format

en.wikipedia.org

https://github.com/rust-lang/cargo/blob/0.78.1/src/cargo/ops/cargo_package.rs

github.com

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

cs.cmu.edu

Running the “Reflections on Trusting Trust” Compiler Read at the source ↗

research.swtch.com

https://github.blog/2023-02-21-update-on-the-future-stability-of-source-code-archives-and-hashes/

github.blog

https://mastodon.gamedev.place/@Doomed_Daniel/112197373095125063

mastodon.gamedev.place

https://docs.github.com/en/rest/releases/assets?apiVersion=2022-11-28

docs.github.com

https://tools.ietf.org/html/rfc1951

tools.ietf.org

https://tools.ietf.org/html/rfc7932

tools.ietf.org

Making my website 10x smaller in 2024, with a dark mode Read at the source ↗

gendignoux.com

https://github.com/google/ngx_brotli

github.com

https://protobuf.dev/

protobuf.dev

https://en.wikipedia.org/wiki/Interface_description_language

en.wikipedia.org

https://seriot.ch/projects/parsing_json.html

seriot.ch

https://langsec.org/

langsec.org

Librsvg is almost rustified now Read at the source ↗

viruta.org

https://github.com/google/boringssl

github.com

https://github.com/aws/aws-lc-rs

github.com

https://github.com/cloudflare/circl

github.com

https://github.com/nss-dev/nss

github.com

Everything I Know About the XZ Backdoor Read at the source ↗

boehs.org

Timeline of the xz open source attack Read at the source ↗

research.swtch.com

https://gynvael.coldwind.pl/?lang=en&id=782

gynvael.coldwind.pl

https://infosec.exchange/@gendx/112236747656751569

infosec.exchange

https://www.reddit.com/r/rust/comments/1bz3okf/thoughts_on_the_xz_backdoor_an_lzmars_perspective/

reddit.com