"Half a Second" — a book on the XZ backdoor [LWN.net]

Adrian Mastronardi has released a book called Half a Second; it is a detailed look into the XZ backdoor attempt of 2024. The book is freely available under a (non-free) noncommercial, no-derivatives CC license.

Half a Second tells that story as one continuous narrative: the burned-out volunteer who maintained the code alone and was patiently, expertly manipulated into giving it up; the engineer whose half-second of curiosity caught the attack through a chain of luck and hard-won instinct; and the operator who built it, who has never been identified and, this book argues, may never be.

Oh no

Posted Jul 18, 2026 18:23 UTC (Sat) by grawity (subscriber, #80596) [Link] (9 responses)

This too seems to be written in the sort of flowery, "sensationalist" (if that's the right word?) style that some LLMs seem to like generating. I skimmed through the first few chapters and it's almost like someone asked a bot "Make this wordier". Or maybe not, maybe that's legitimately the author's writing style. Either way, it's good that the story is well-referenced, but it soon gets repetitive and more than a bit grating to read.

Oh no

Posted Jul 18, 2026 21:45 UTC (Sat) by linuxrocks123 (subscriber, #34648) [Link]

Some people write like that. I once spent $2.50 in ILL fees to check out "How Not To Network A Nation: The Uneasy History of the Soviet Internet." It turned out to be one of the most awful books I've ever tried to read, primarily because it was written in the style you're describing but also because it wasn't about anything resembling an attempt to create an Internet. I returned it without reading much of it because that way I only wasted my money, not my time.

Oh no

Posted Jul 18, 2026 21:55 UTC (Sat) by richard_weinberger (subscriber, #38938) [Link] (2 responses)

There is for sure a lot of AI involved.
https://github.com/AdrianMastronardi/bookwright

AI polished

Posted Jul 19, 2026 7:45 UTC (Sun) by shemminger (subscriber, #5739) [Link] (1 responses)

Asked Claude if it was AI.

Verdict: human-owned research, argument and sourcing; model-smoothed prose. The reporting discipline is the part a model doesn't fake, and it's present.

The tell was perfect English prose from a writer whose first language is Spanish

AI polished

Posted Jul 19, 2026 11:03 UTC (Sun) by tux3 (subscriber, #101245) [Link]

> The tell was perfect English prose from a writer whose first language is Spanish

Very excited to find out Claude's standard for perfect English prose is... Claude's past output.

I also like the little sideswipe at ESL writers. How do you tell AI output from human output? Why, not any of the dozens of distinctive LLM tells that we're tired of seeing. If they're a Spaniard it must be AI, cause those guys can't write no good!

Oh no

Posted Jul 19, 2026 10:05 UTC (Sun) by jd (guest, #26381) [Link] (1 responses)

Honestly, it's no worse than "Hackers, Heroes of the Computer Revolution". Arguably, it's better, as there's no side-tracking into "adult entertainment" (which Hackers does on three separate occasions).

Tabloid journalism is going to happen and it does help explain stuff to people who aren't geeks.

Oh no

Posted Jul 23, 2026 14:40 UTC (Thu) by ejr (subscriber, #51652) [Link]

Yeah, but the Hackers book came out in a different world. Sure, I was reachable via a few of the BBS networks (WWIVnet, primarily), but you would have to effectively bang-route non-local messages, and they'd take quite a while to arrive if at all. I think my first post on USENET was in 90 or so, but I'm not up to digging through what's left of the archives.

News was either by the morning paper, the radio, or the evening news TV show. The 24x7 bombardment had not yet begun except for the people who paid for cable and CNN. Much, arguably most, TV was still over the public airwaves. (Did anyone think the Simpsons would become such a force? And would anyone believe FOX was so revolutionary with that and In Living Color?)

A book like Hackers was written in an appropriately sensationalist style for back then. I've met some of the characters since, and, well, maybe they were nicer people "back in the day." Maybe not. But the book's still an amusing throw-back to a bridging time.

Oh no

Posted Jul 19, 2026 10:13 UTC (Sun) by sj (guest, #185124) [Link]

They definitely had some Claude assistance IMO. This sentence from the "Blood in the Water" chapter screams Claudespeak:

> This is the seam where the investigation’s discipline shows, and it is worth marking what Freund did not yet claim.

Claude seems to love certain words and phrases such as "seam", "spine", "load-bearing", "it is worth XYZ", and so on.

Oh no

Posted Jul 20, 2026 15:39 UTC (Mon) by ethanhawksley (guest, #185218) [Link] (1 responses)

I've been writing a book called "500 Milliseconds" about the xz backdoor for the past month and a bit. I was very surprised when I found out somebody had beat me to it 😅️. It'll be available free on my site or as an ebook, and unlike this one it's entirely human written.

Oh no

Posted Jul 23, 2026 16:46 UTC (Thu) by jadedctrl (subscriber, #178426) [Link]

What’s your site’s URL? I’ll be looking forward to it!

Russ Cox's timeline and attack script analysis

Posted Jul 18, 2026 19:15 UTC (Sat) by jbosboom (guest, #176381) [Link]

For technical readers, Russ Cox's xz attack timeline strikes a good balance between brevity and detail. Russ also walks through the attack shell script in gory detail.

AI Disclosure

Posted Jul 19, 2026 19:33 UTC (Sun) by Jordan_U (subscriber, #93907) [Link]

Given the existence of https://github.com/AdrianMastronardi/bookwright , I believe that you have a responsibility as a journalist to add a note to this article mentioning the heavy use of AI in writing this book.

(Or possibly less strong / certain language; I trust you to get that balance right)

this is a great read

Posted Jul 20, 2026 17:40 UTC (Mon) by dankamongmen (subscriber, #35141) [Link] (1 responses)

thirty pages in, i'm really enjoying this. clear writing full of facts. i hadn't known about the valgrind bit, for instance, which changes things a good bit in my mind.

regarding whether ai was used: stop pretending there are differences. it's all matmuls.

this is a great read

Posted Jul 30, 2026 11:41 UTC (Thu) by Funcan (guest, #44209) [Link]

There's definitely practical and moral differences between human created and AI generated text. I am very confused how somebody could claim otehrwise with a straight face

"Half a Second" — a book on the XZ backdoor

Physical book?

Physical book?

Oh no

Oh no

Oh no

AI polished

AI polished

Oh no

Oh no

Oh no

Oh no

Oh no

Russ Cox's timeline and attack script analysis

AI Disclosure

this is a great read

this is a great read