this post was submitted on 29 Mar 2024
173 points (100.0% liked)

Selfhosted

45508 readers
745 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
all 9 comments
sorted by: hot top controversial new old
[–] [email protected] 35 points 1 year ago

There's talk on the Linux kernel mailing list. The same person made recent contributions there.

Andrew (and anyone else), please do not take this code right now.

Until the backdooring of upstream xz[1] is fully understood, we should not accept any code from Jia Tan, Lasse Collin, or any other folks associated with tukaani.org. It appears the domain, or at least credentials associated with Jia Tan, have been used to create an obfuscated ssh server backdoor via the xz upstream releases since at least 5.6.0. Without extensive analysis, we should not take any associated code. It may be worth doing some retrospective analysis of past contributions as well...

[–] [email protected] 18 points 1 year ago
[–] [email protected] 9 points 1 year ago

In case, like me, you were wondering what this has to do with ssh:

openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma.

[–] [email protected] 6 points 1 year ago* (last edited 1 year ago) (1 children)

Wow... Luckly I don't use systemd which seems to be the vector causing the sshd backdoor, via liblzma...

Pretty scary anyway.

[–] [email protected] 5 points 1 year ago