ngn@lemy.lol to Memes@lemmy.mlEnglish · 1 year agolove is in the air?lemy.lolimagemessage-square45linkfedilinkarrow-up1349arrow-down140
arrow-up1309arrow-down1imagelove is in the air?lemy.lolngn@lemy.lol to Memes@lemmy.mlEnglish · 1 year agomessage-square45linkfedilink
minus-square30p87@feddit.delinkfedilinkarrow-up24arrow-down2·1 year agoArch isn’t affected afaik, as it specifically targeted Debian and RPM. Also, sshd isn’t linked against liblzma (or something along those lines). And I hope that’s true, because otherwise, I had a backdoor on a public system for over a month.
minus-squareReversalHatchery@beehaw.orglinkfedilinkEnglisharrow-up16·edit-21 year ago Also, sshd isn’t linked against liblzma Not directly, but it’s loaded through libsystemd. It is there. Edit: except on arch, if you use that. That doesn’t use libsystemd
minus-squareu/lukmly013 💾 (lemmy.sdf.org)@lemmy.sdf.orglinkfedilinkEnglisharrow-up12·edit-21 year agoAnd the packages on most distros should be long updated by now. Even Termux updated to 5.6.1+really5.4.5 just 2 hours after Arch Linux.
minus-square30p87@feddit.delinkfedilinkarrow-up4·1 year agoI just updated all packages in Termux actually lol
minus-squareu/lukmly013 💾 (lemmy.sdf.org)@lemmy.sdf.orglinkfedilinkEnglisharrow-up1·1 year agoWhat package manager is that?
minus-squarengn@lemy.lolOPlinkfedilinkEnglisharrow-up1·1 year agoI think it’s nala, which is a wrapper for (lib)apt
minus-squarePantherina@feddit.delinkfedilinkarrow-up1·1 year agoNala, Termux is Debian based and its pkg is basically apt
minus-squarewildbus8979@sh.itjust.workslinkfedilinkarrow-up7arrow-down1·1 year agohttps://archlinux.org/news/the-xz-package-has-been-backdoored/
minus-squareHopFlop@discuss.tchncs.delinkfedilinkarrow-up8·1 year agoYeah but the backdoor does not work on Arch (as far as we currently know). It relies on a linking of libraries that Arch doesnt do by default.
minus-square30p87@feddit.delinkfedilinkarrow-up7·1 year agoAnd as https://www.openwall.com/lists/oss-security/2024/03/29/4 says: “These conditions include targeting only x86-64 linux: […] Building with gcc and the gnu linker […] Running as part of a debian or RPM package build:” I’m not an expert of course.
minus-squarebrvslvrnst@lemmy.mllinkfedilinkarrow-up2·1 year agoHoly shit that was a hell of a dive. And no wonder the dude got it working, he was just pounding those “test and translation” commits
Arch isn’t affected afaik, as it specifically targeted Debian and RPM. Also, sshd isn’t linked against liblzma (or something along those lines). And I hope that’s true, because otherwise, I had a backdoor on a public system for over a month.
Not directly, but it’s loaded through libsystemd. It is there.
Edit: except on arch, if you use that. That doesn’t use libsystemd
And the packages on most distros should be long updated by now.
Even Termux updated to
5.6.1+really5.4.5just 2 hours after Arch Linux.I just updated all packages in Termux actually lol
What package manager is that?
I think it’s nala, which is a wrapper for (lib)apt
Nala, Termux is Debian based and its
pkgis basically apthttps://archlinux.org/news/the-xz-package-has-been-backdoored/
Yeah but the backdoor does not work on Arch (as far as we currently know). It relies on a linking of libraries that Arch doesnt do by default.
And as https://www.openwall.com/lists/oss-security/2024/03/29/4 says:
“These conditions include targeting only x86-64 linux: […] Building with gcc and the gnu linker […] Running as part of a debian or RPM package build:”
I’m not an expert of course.
Holy shit that was a hell of a dive. And no wonder the dude got it working, he was just pounding those “test and translation” commits