From: Andreas Enge <andreas@enge.fr>
To: Ekaitz Zarraga <ekaitz@elenq.tech>
Cc: "Ludovic Courtès" <ludo@gnu.org>,
"Attila Lendvai" <attila@lendvai.name>,
"Giovanni Biscuolo" <g@xelera.eu>,
"Guix Devel" <guix-devel@gnu.org>
Subject: Re: backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils)
Date: Thu, 11 Apr 2024 15:49:48 +0200 [thread overview]
Message-ID: <ZhfqfMcKgBSq6PDQ@jurong> (raw)
In-Reply-To: <8076578a-bebd-0f26-6d39-f634ded290ce@elenq.tech>
Am Thu, Apr 11, 2024 at 02:56:24PM +0200 schrieb Ekaitz Zarraga:
> I think it's just better to
> obtain the exact same code that is easy to find
The exact same code as what? Actually I often wonder when looking for
a project and end up with a Github repository how I could distinguish
the "original" from its clones in a VCS. With the signature by the
known (this may also be a wrong assumption, admittedly) maintainer
there is at least some form of assurance of origin.
> and everybody is reading.
This is a steep claim! I agree that nobody reads generated files in
a release tarball, but I am not sure how many other files are actually
read.
Andreas
next prev parent reply other threads:[~2024-04-11 13:50 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-29 20:57 Backdoor in upstream xz-utils John Kehayias
2024-03-29 17:51 ` Ryan Prior
2024-03-29 20:39 ` Felix Lechner via Development of GNU Guix and the GNU System distribution.
2024-03-29 20:55 ` Tomas Volf
2024-03-30 21:02 ` Ricardo Wurmus
2024-04-04 10:34 ` backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils) Giovanni Biscuolo
2024-04-04 15:12 ` Attila Lendvai
2024-04-04 16:47 ` Giovanni Biscuolo
2024-04-04 15:47 ` Giovanni Biscuolo
2024-04-04 19:48 ` Attila Lendvai
2024-04-04 20:32 ` Ekaitz Zarraga
2024-04-10 13:57 ` Ludovic Courtès
2024-04-11 12:43 ` Andreas Enge
2024-04-11 12:56 ` Ekaitz Zarraga
2024-04-11 13:49 ` Andreas Enge [this message]
2024-04-11 14:05 ` Ekaitz Zarraga
2024-04-13 0:14 ` Skyler Ferris
2024-04-19 14:31 ` Ludovic Courtès
2024-04-13 6:50 ` Giovanni Biscuolo
2024-04-13 10:26 ` Skyler Ferris
2024-04-13 12:47 ` Giovanni Biscuolo
2024-04-14 16:22 ` Skyler Ferris
2024-04-12 13:09 ` Attila Lendvai
2024-04-12 20:42 ` Ludovic Courtès
2024-04-13 6:13 ` Giovanni Biscuolo
2024-05-07 18:22 ` 3 kinds of bootstrap (was Re: backdoor injection via release tarballs combined with binary artifacts) Simon Tournier
2024-04-05 10:13 ` backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils) Giovanni Biscuolo
2024-04-05 14:51 ` Attila Lendvai
2024-04-13 7:42 ` Giovanni Biscuolo
2024-04-04 23:03 ` Ricardo Wurmus
2024-04-05 7:06 ` Giovanni Biscuolo
2024-04-05 7:39 ` Ricardo Wurmus
2024-04-05 16:52 ` Jan Wielkiewicz
2024-03-31 15:04 ` Backdoor in upstream xz-utils Rostislav Svoboda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZhfqfMcKgBSq6PDQ@jurong \
--to=andreas@enge.fr \
--cc=attila@lendvai.name \
--cc=ekaitz@elenq.tech \
--cc=g@xelera.eu \
--cc=guix-devel@gnu.org \
--cc=ludo@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.