A backdoor in xz
A backdoor in xz
Posted Mar 31, 2024 9:22 UTC (Sun) by smurf (subscriber, #17840)In reply to: A backdoor in xz by DimeCadmium
Parent article: A backdoor in xz
They all rely on picking a good time that happens to *work*.
There are plenty of situations where, once you're *really* started, it's no longer possible to signal "OK I'm alive now" by double-forking.
Writing a PID file has its own class of race conditions, the handling of which I can guarantee most users of that method get fatally wrong.
And so on.
> "Don't worry about our vulnerabilities, other people have vulnerabilities too!" "Don't worry about our bad design, other people have bad design too!"
Don't blame the messenger. If linking to a library you don't strictly need *in your particular situation* is a "vulnerability" or "bad design" I can guarantee that 90+% of programs out there suffer from it.