The Worst Hack Ever Almost Just Happened

[@CentreMetre]

Imagine how pissed off that guy who put the backdoor in is, years of work gone, all cos some guy wanted a fraction of a percentage more performance

[@ThioJoe]

He was definitely punching the air

[@Locomaid]

It won’t be the only one he’s working on…

[@volvo09]

It's scary to wonder how many hidden backdoors are out there, but remain unused.

[@patfre]

Actually it wasn’t a faction of a percent it was drastically slower than it should be. If I recall it was like .5s slower than it should be which is a lot in the computer world

[@goiterlanternbase]

Imagine having foreseen this and loosing one of 300 similar backdoors😉

[@gosnooky]

Moral of the story is never come between a database engineer and performance.

[@Stratelier]

It is amusing that, for benchmarking purposes, the engineer who found it was sending SSH requests that shouldn't even pass a sanity check ("wrong username, etc") which explains why he got suspicious of some excess cpu cycles so quickly.

[@Lollllllz]

If he could be working on windows' explorer/taskmanager instead 11's wouldn't be slow as it is.

[@ivok9846]

@@Lollllllz usually one can keep taskman on all the time. not on win11

[@stroodlepup]

@@Stratelier lmao

[@blikthepro972]

remember: the best backdoor is already running, is everywhere, and no one knows about it

[@TomNook.]

Except the NSA / MSS / FSB / Unit 8200

[@scrapmine]

Its called braking in irl. (This is a joke youtube, pls no ban)

[@dokchampa9324]

Ah, fearmongering, my favorite

[@LostShadowGD]

The virus Microsoft puts in win 11

[@GHaKKt]

Humans..

[@Ascendor81]

I must now change my password from "1234" to "12345" to protect myself.

[@samuelhulme8347]

Technically no matter how strong your password is this back door completely bypasses all passwords because it injects the hacker’s ssh keys onto the infected device.

[@Jonesy1701]

@@samuelhulme8347 I remember my first joke too...

[@NotSoMuchFrankly]

How did you know what my password was?🤔🧐

[@SereneStrategist-kk7mk]

I don't know how you got my passwords but you don't scare me I already changed it into something more secure. With six digits it almost impossible to guess mynew one.

[@samuelhulme8347]

@@SereneStrategist-kk7mk is it “123456”?

[@D.von.N]

I think Seytonic covered this a month ago. But it doesn't hurt to remind ourselves: 1. Social engineering is a thing, 2. Pay developers what they are worth.

[@NigelTolley]

I don't think anyone ever gave the guy any money at all. Then he gave up, and the bad actor(s) took over.

[@Fircasice]

How are you going to pay software engineers working on open source software for free?

[@D.von.N]

@@Fircasice Many so called free software are open to donations. And people donate. Some of the money could be paid to the developers.

[@DavidM2002]

To quote that old adage, "You have to be good all of the time. They only have to be lucky once."

[@dekeonus]

I'm going to have to say: it's not an adage, it was a (very real) threat to Margaret Thatcher. It's still applicable in this case, just a better phrasing might have been: I'm reminded of the IRA's threat to Thatcher: "Today we were unlucky, but remember we only have to be lucky once - you will have to be lucky always."

[@NinjaRunningWild]

You don't have to be good all the time*

[@Jonesy1701]

@@NinjaRunningWild No I think he was correct. We (the good guys) gotta be good all the time, they (the attackers) only gotta be lucky once.

[@JiggyJones0]

​@@NinjaRunningWildpoint: You

[@ottergauze]

The fact this was just discovered by chance really brings into question how many other packages have similar backdoors. This is the kind of stuff that should spur a major investigation.

[@321Jarn]

​@An_EqualNot the FBI or CIA obviously, one of the founders of telegram said the FBI was trying to trick him into using open source libraries for telegram.

[@ottergauze]

@An_Equal Beats me, but it's probably not just gonna be one singular entity.

[@I.____.....__...__]

Like Andreas said himself, this was just incredibly lucky, just a massive coincidence that he happened by chance to be in the perfect position to find it (and _just barely_ in time). A confluence of events like this rarely happens, so it's possible that there is indeed a lot of stuff going undetected. 😕

[@mega_gamer93]

There is a "major investigation". This backdoor has sparked discussion on how to prevent something similar from happening again, made some free software contributors try to audit other software and once again demonstrated the absurdity of a "software supply chain" where the companies don't pay a dime to their "suppliers" yet expect them to do the most rigorous work to avoid hurting their (the corporations) bottom line

[@uponeric36]

@@internet8080 Ok, post proof then.

[@mr.purger9185]

Bro is flexing proper subtitles 😎 my guy

[@balsalmalberto8086]

Time stamps, subtitles. Bro is a role model

[@staffeyx]

Invaluable

[@jasonlittle6542]

This is the biggest weakness with OSS, but also the greatest strength of it. Anyone can worm their way into a seemingly innocuous part of the Linux ecosystem and taint it. But also anyone and everyone can topple years of nefarious actions through simple curiosity.

[@squirlmy]

the fact this got caught, while Windows CVEs get put out and many admins don't update, leaving vulnerabilities in place for years! Notpetya took advantage of an years old vulnerability in Windows, and caused over $11 billion globally

[@TheGreatAtario]

By the same token, it's not hard for a nation-state entity to get an agent hired at a private software company

[@marcforrester7738]

Yeah nothing's going to be 100% secure at all times, the payout from successful attacks is just too big. What OSS has is a living immune system, the ability to heal.

[@MrDowntemp0]

The whole linux sphere has been talking about this a lot, but yeah, I think you're the first tech channel with a more general focus I've seen bring it up.

[@UmVtCg]

Not just the linux bubble, the whole Cyber Community.

[@MrDowntemp0]

@@UmVtCg I bet you're probably right, I just don't tend to haunt that corner of the net.

[@marcellkovacs5452]

@@UmVtCg I wouldn't say I'm in the Linux sphere and I'm definitely not in the cyber community and I still knew about it. It was pretty much impossible not to hear about it if you're in the "IT scene" in any capacity.

[@squirlmy]

@@marcellkovacs5452 Its irritating the title is "Almost Just Happened"! no, over a month an a half ago. Clickbait.

[@mdmackint]

Two Thio videos in one day is a win in my books

[@8yt3]

правда радует

[@kuzeyrl]

yess

[@MetsLand]

Agreed

[@balsalmalberto8086]

That's what SHE said!

[@ToastExists]

real

[@WindowsAurora]

The xz backdoor story is crazy.

[@andrewwatson5324]

Not so crazy when you consider that at some point some one probably got themselves hired in order to put in the Juniper back door. This was found about 10 years ago.

[@TomNook.]

Jia Tan is a Chinese name, Jigar Kumar is an Indian name. People who want to stay anonymous won't use their names, but also doesn't want to introduce a rival nation to investigate (so he didn't use a german name for example), so quite likely a hacker of russian origin. Isn't geopolitics wonderful.

[@Reddotzebra]

So the backdoor would likely quietly delete itself if it detected a Russian keyboard. Making it legal for your citizens to attack any system as long as it's not one your nation owns is a stroke of genius, ngl. I wonder how much money they've saved on buying day zero exploits from the usual sources?

[@NinjaRunningWild]

Non-sequitur. Nothing can be deduced from the name.

[@mega_gamer93]

'Cheng" is a cantonese name while "Jia" isn't. This indicates however made the backdoor just tried to think of a name that sounds Chinese enough. Such sloppiness is typical of the US But trying to deduce the perpetrator from the name is stupid anyway, we could go in circles all day talking about potential 5d chess by the perpetrator

[@MiseRaen]

​@@mega_gamer93The OP just have the politics brainrot. The culprits might be multinational anyways.

[@shanent5793]

"Gee-yah" isn't Chinese, it only looks that way. In Chinese it's only one syllable.

[@theRPGmaster]

As a software developer, I have no doubts that this kind of vulnerability (probably multiple) is already deployed everywhere, undetected. Never underestimate the power of social engineering, and these attacks being very easy to miss. Also I remember when ThioJoe had very few subscribers, I'm delighted to see the channel grow like this. I wonder if he remembers me 🤔

[@NotSoMuchFrankly]

Probably like Pegasus on every phone.

[@Cutest-Bunny998]

Hardware backdoors are amazing for government use but amazingly we don't hear much publicly about that obvious attack vector...

[@ronin36963]

Drive-By Mining. You have to give these guys credit for being innovative.

[@Graham6410]

Wouldn't be surprised if this has happened to other bits of open source software at some point.

[@I.____.....__...__]

Like the xkcd comic Joe showed said, there are a LOT of bits of archaic code that underlie the world's software. We've seen cases where half the Internet broke because software relies on a single function that someone wrote for themselves 25 years and everybody copied. Software is more fragile than people would like to think.

[@sunla]

We've gotten so spoiled with our technology, we need more code and more programs and more features to cover every base. Thing is, the more we have, the more hands and minds work on the code that run on our machines. That definitely comes with its risks. The truly scary thing to think about is that... logic dictates that the worst is yet to come.

[@EmilyS-gk3st]

And thing is, we can live without most of it, too. Our ancestors even 200 years ago did.

[@delta_cosmic]

2:20 norton disliked this video

[@volvo09]

Haha, I couldn't believe they tried that. What a scummy company.

[@milentoshev8409]

@@volvo09 What are you referring to? What did they try?

[@Sarah-3]

@@milentoshev8409 Their antivirus software became the virus. Granted it was opt in but there were multiple popups urging you to opt in telling you how great crypto is. They failed to mention about the wear and tear of hardware and the performance impact on other tasks. To top it all of they would not only skip paying the electricity bill they also took a 15% cut from your earnings

[@andreobarros]

@@milentoshev8409 I dont remember all the details, but norton or one of their products had or has a crypto miner within them. They stealthily made it opt-in by default, and when found out tried some justification.

[@AndrewYac]

@@milentoshev8409 Norton tried to install crypto miners in their software without making it clear in the install process lol

[@KaldekBoch]

As someone on the defensive line working at scale (170,000 users), you do what you can with the control that you've *got* to avoid these issues, but you are mostly at the mercy of others. Where you *really* need to focus your efforts as a defender is being able to detect *when* you've been breached. Our goals are pretty clear - detect within 10 minutes, contain within 60 minutes. That's how fast you need to be, and some would argue that's not fast enough.

[@locinolacolino1302]

My Dad's mate was managing server infrastructure at a hosting company around 2010, and decided to deploy a crypto miner as a cheeky experiment for his team. It was a bit after a fortnight when the team found out, and they chewed him out for misusing company resources, but he immediately returned the blame to them. 'You're saying, if there was actually a piece of malicious software running on our systems, it'd take you two weeks before anyone realizes something's wrong?'

[@MichaelGrundler]

At first I thought this video is quite a bit late. I've already seen multiple videos about this backdoor right around the time it was discovered. However I'm glad I watched till the end because this video provided some additional information and context I didn't know of yet.

[@anstropleuton]

I did not expect it to be a topic of XZ... thought this video was some windows thing Also yeah way late

[@robonator2945]

I wouldn't really say this "just" happened, it was a decent bit ago, but yeah, it could have been bad. One thing that's kind of annoying though is, well actually sort of two things, but both are alarmism 1 : "HOW MANY MORE COULD EXIST THAT WE DON'T KNOW ABOUT?!?!?!" No, this was discovered like a month after the impacted version first released precisely *_because_* everyone had eyes on it. This is the point of open source, *_everyone_* is watching, so millions and millions of tax dollars mean nothing. One random dude doing some basic benchmarking spotted that what *_should_* have been a basically instant no-op was taking over half a second and a decent chunk of compute, then identified this backdoor years in the making. If you are wearing a bulletproof vest, then get shot, and it gets stopped, you don't then say "woah, imagine how many other times I've been shot and I don't even realize it! I mean sure this vest I put on specifically to stop it stopped it, but that was just pure chance!" 2 : "See?! Open source isn't more secure!", except, 2.1 : see above, 2.2 : this exploit specifically abused how XZ was being distributed to have what is basically a closed source component be delivered with the final product. We do not have the source code for the exploit so, definitionally, the exploit was not open source. Since it was part of the project, that means part of the project was not open source. This attack had to reinvent the wheel several times over to hide itself ( and, again, still got caught instantly ) precisely *_because_* it was in an open source repo. 2.3 : your jordans are fake; this argument relies on the tacit assertion that this is an attack that hasn't been carried out on proprietary software several dozen times over. Not finding a vulnerability or not having it disclosed isn't real security, it's just feigned security. The reality is this is a prime example of exactly why open source is so secure. Allllll of this time and money, full fledged psychological warfare, completely innovative attack vectors, etc. were all rendered completely and utterly meaningless because, against the millions and millions of nerds running automated checks and test scripts, they *_are_* utterly meaningless.

[@uponeric36]

That's exactly how I feel too. Tons of doomer talk over this attack even though literally nobody was impacted lmao and the attackers wasted years of effort to be shutdown over night. Malicious code can't just magically silently interact with software and hardware. It always has some impact on the system via the fact it has to run code, and that can be detected. Files not in the source code can be found with programs as simple as winmerge. This was always a doomed attack vector hinging on luck that no one would notice before they hit their target.

[@robonator2945]

​@@uponeric36 I wouldn't quite go that far, this is a very real attack vector that does need to be addressed. The fact that the wider open source community was *_ever_* okay with non-source-controlled files being included in the release builds is a massive red flag, as is the fact that build pipelines aren't themselves included in the repository. This wasn't a purely 'luck' attack, it did exploit some legitimate vulnerabilities with the culture around open source, particularly around people's willingness to accept "ohh it's just a hobby project their not getting paid for" as an argument that works in tandem with " *_the entire linux ecosystem relies on this package_* ". The reality is the build and release pipeline for open source *_has_* been overlooked as meaningless tertiary shit, when that's far from reality. There are some legitimate security holes in that area of how open source is typically managed, but that doesn't mean it's doom and gloom. Those are vulnerabilities that we should address, but my point is that a lot of people treat this like it's some cautionary tale when, by basically any account, thjis was handled borderline flawlessly. Sure, there was some evidence going back years, but if we're honest, go back to January of this year and all of that evidence is circumstantial and non-actionable. It was a few dodgy accounts that might be sock puppets, a few odd commits, etc. Realistically speaking this was caught like a month after it was even possible to catch it. There are definitely some lessons that need to be learned here, but it's not the sign of the end times so many people are acting like it is.

[@uponeric36]

@@robonator2945 You're right, I'm just layman lol. It is wild to me in retrospect that having files like that in the final build is "part of the culture" I still feel like this was a perfect storm moment - the attack formed partially by negligence, but also against the odds of all the other security measures in place. Ultimately, the odds worked against it. There's what I was considering luck, but "pure" *is* a strong word.

[@yesterdaysrose5446]

Remember: As an open source maintainer, you should keep an eye on the stuff coming in and just not accept incoming stuff if you don't know WTF it even DOES. (That's the technical term.) But I also realise that if you have relinquished the nominal control to someone else, you're not culpable.

[@Derpingtonshere]

I fully agree with this, but the problem was these so called contributors were intentionally bringing up so called "problems" causing the developer to burn out. Nobody remembers that these people do all this without guaranteed pay, they volunteer their time to better the open source atmosphere. It's really sad that people have to take advantage of good hearted people like this. This is why I always chip a few dollars their way whenever I can. We should try and keep these people happiness high. The actual owner was on Hiatus and gave the reigns to a person he thought he could trust, well that person was taking advantage of his burnout.

[@dputra]

My first contribution was the Harvard's cs50 class CLI tool, translating it to my language Indonesian so my high school students can use it more easily. The maintainer raised this exact issue, "how do we know he pushed something legit, not troll translations?" That's how I realized that while open source contribution is a cool way to collaborate, some people might have malicious intentions and maintainers should try their best to prevent it.

[@NotAghostSpeedruns]

@@dputra They could probably chuck it into deepl translate and most of it would make sense. Having a native speaker translating seems like an improvement over any automated translations though.

[@dputra]

@@NotAghostSpeedruns deepl is not even there yet at the time, only google translate which sucks at translating indonesian to english.

[@_EmptyBox_]

Nothing had made it to the news where I live regarding this. Some tech channels on YT I follow covered the bare bones when this was first discovered, yet the background you've provided has created such a broader and more chilling account of what was really happening.

[@doge7831]

This backdoor only affected amd64 systems (so ARM computers wouldn’t have been affected) and it would likely take some time before it got into Debian and Ubuntu LTS (used by a ton of servers), as they only receive non-security updates every ~2 years, so if it was discovered 1 month later, we would probably be fine.

[@user-28qhfk65]

1. If I remember correctly, there's a code that check specifically for amd64 (and x86?) architecture for it to run. (sus imo) 2. We're very lucky that the backdoor was found before it was released into stable Ubuntu LTS 24.04 release on April 2024. That might be the attacker's main target. 3. The fact that it was found by coincidence by microbenchmarking, ~500ms delay, is very concerning. 4. The attacker will learn from this mistake and might pull something like this again / another party is inspired by this move will do it in the future.

[@nicholasvinen]

For some value of "fine". Yes it wouldn't have been a disaster but some servers would have been compromised for some time.

[@wisteela]

When this happened it got me thinking maybe it's time for a big code audit?

[@EquaTechnologies]

the person should not have added a new maintainer that's why you shouldn't trust anyone it sucks that contribution was abused

[@Reddotzebra]

Trust = Weakness

[@mega_gamer93]

"Just keep doing unpaid labor despite being burned out"

[@Claren.c]

Scary... I needed to check this

[@5argetech56]

Zoinks!! Wow Scooby that was a close one.. Whew!

[@cheesepizza98]

>>>>>>>>Is this>>>>>>>>>>>>>

[@RobTheMusician1]

Those antivirus softwares are useless. We need more performance tweakers.

[@Nadia1989]

The mantainer needs acknowledgement too. Having a life helped to deter the attack.

[@MonteVanNortwick]

Yup. How could we know if backdoors already have been installed? Until...they are discovered. It could be a million or it could be zero.

[@HKlink]

I'd heard of this, but not the full story. Essentially just heard "some guy was drag racing his computer for fun and noticed a tiny inefficiency which was a brand new back door, catastrophe prevented" and not all the cool details you gave! Thanks for this video.

[@REMY.C.]

I'm not a programmer and I immediately spotted the "." because I don't like when it's not tidy 😂

[@alexander_228]

Wtf is up with your neck?) On 7:42 for example.

[@erikhicks07]

Imagine the backdoors and obfuscated malware code we _don't_ know about. Too much code to review in a time where people are barely paid to do the minimum requirements. A ticking timebomb.

[@AraiDigital]

“And I would have gotten away with it if it weren’t for that benchmarking kid!!”

[@brownjames112]

Heard about this the other day on the 2.5 Admins Podcast and the Late Night Linux Podcast, good to hear from some other people. It's a pretty big deal.

[@FlyRetroGamer]

Please note that Ubuntu is Debain under the hood.

[@diamondblack3776]

You can do your own micro benchmarking and analysis with Process Monitor from sysinternals and run it as administrator. Picks up background accessing.

[@o0shad0oo]

Microbenchmarking, huh? What do you think the odds are that a different state actor has been monitoring the codebase and looking for inserted backdoors. They might even have been behind the security enhancement to the other library that would've disabled the backdoor and only revealed it publicly when the backdoored library's release looked like it might be getting pushed forward.

[@benyomovod6904]

I bet the NSA planted the ultimate backdoor into silicon long ago. It is absolute logical

[@aylivex]

I knew about the backdoor since the time it was discovered in March 2024. The backdoor was discussed, it seemed, everywhere, I also watched a few videos which explained what it was and the consequences if it weren't discovered in time.

[@User0000000000000004]

Dee-bee'in? WTF??? It's Deb as in Deborah and Ian as in Ian. DebIan. How could you screw that up?!

[@dualbeardedtech]

I had heard about it but, like you said, it was only from tech news outlets. Thank you for making a bid about this!

[@RajarshiKhatua100]

you are late everyone was early

[@RajarshiKhatua100]

jia is the real hero

[@Zestied]

stop hating

[@RajarshiKhatua100]

​@@ZestiedI am not hating, I love thio

[@ChrisHeatonbigears5000]

I love your coverage on topics like this. I find it so interesting and you do a great job of explaining the process. Great video.

[@russian_alex]

idk what to comment (nice video thio, keep up the good job)

[@_SJ]

Wow ThioJoe. Second video for today. I ❤ it

[@NinjaRunningWild]

Low Level Learning covered this right after discovery. His video is also worth watching.

[@nou712]

He also said it's the end of open source and linux.

[@eldibs]

This would make me paranoid about security if I wasn't already paranoid from the time I (temporarily, to test something) opened up SSH access over the internet to a Linux machine on my network and saw it immediately get hit with constant brute-force login attempts.

[@xX_ang3Lz]

this is crazy i remember you telling me to tape batteries to my cat5 to make my internet go faster

[@UmVtCg]

This would have worked on servers connected to the internet by SSH. Nobody in their right mind should EVER expose port 22 directly to the internet.

[@dekeonus]

this would have only affected systemd systems running openssh (with custom patches for openssh). What remote access tool should people be using to control their remote systems?

[@icantcomeupwithnames469]

​@@dekeonustelnet

[@UmVtCg]

@@dekeonus VPN, and yeah... One can run anything through a vpn tunnel even an SSH connection. As I said no firewall or edge device should EVER have port 22 exposed directly to the internet.

[@dekeonus]

@@UmVtCg I think you've overstated the risk. You've just switched one attack vector for another: With SSH one should be using ip[v4|v6] whitelisting, restricting to certain users (or group) and only permitting public-key auth (and possibly gssapi) your attack surface is largely similar to a VPN.

[@Norman_Fleming]

Was aware of this but good it is still getting coverage. Really feels like this house of cards is not gonna stay up much longer.

[@rodrirm]

First time I heard about this, thank you for sharing.

[@Pest789]

1:08 "A software" 🤦🏻‍♂ Software is a mass noun, just like hardware. You wouldn't say "The RTX 4090 is a hardware", so you shouldn't say "this backdoor was in a software" either, FFS.

[@BombadilBeardie]

Explained very well. Heard from another youtuber but he made it all the way more complex

[@mirai5268]

this old af

[@lpoki8897]

So what I'm getting here is that they found out that XZ had one dev, and that dev was a target because of their health. And then they put pressure there to get themselves as maintainer. xkcd memes are just reality, I feel I see this with all software closed or open. There's like one thing that everyone relies on but has zero resources put towards it. It would be nice to see these distros run by big teams to go over what they use. And send resources to software like XZ.

[@abdulrahimanis584]

You're late to the party, bro

[@landroveraddict2457]

Take a look at a book by Clifford Stoll, The Cuckoo's Egg. Awesome book based on a first hand account of a sysadmin's take down of a major hacking group in the 80s. The admin spotted micro theft of CPU time on a mainframe he managed. It really is worth a read. Not too technical, just enough to explain the operation of the earliest hackers.

[@dshack4689]

Also Takedown by Tsutomo Shimomura, as well as the respone from Kevin Mitnick The Fugitive Game

[@DynamicLights]

God saved almost all of the servers in the world.

[@frankintx699]

Thanks, ThioJoe

[@d.developer]

fireship covered this on the 1st april. and following that i was LowLevelProgramimng, primeigine and others Linux enthusiast covered this topic. i think you are late in this one :)

[@2kadrenojunkie]

this a re-up? this is old news.

[@my-yt-inputs2580]

I remember back when the Linux snobs swore up and down that it was secure. Of course back then it was, compared to Windows. Fast forward.......!

[@mega_gamer93]

You can't know of backdoors on windows because it is proprietary. Imagine the same situation if sshd was proprietary >Notice that ssh is marginally slower than normal >file bug report to SSH companies website > "Your report is being investigated, we will update you over email if new information is found" >Email gets completely ignored

[@AresEverett]

Are we sure the attack was planned beforehand? Maybe the guy who had the maintainer role changed his mind or his account got stolen? Because waiting 2 years to do this doesn't make much sense

[@mega_gamer93]

If the guy were compromised he could post an email telling so. Unless the attacker broke into his house and deleted his PGP key he can always prove his identity. Besides, it makes sense to take this long to introduce this backdoor, there was a lot of groundwork that needed to be made

[@disegnosys]

Great explanation and I heard about this threat about a month ago on another channel.

[@DudeSoWin]

Performance is number one Safety Third

[@BigWhoopZH]

Warns about one malware, advertises another.

[@ranxlusactualmainaccount]

ThioJoe got a 2 vid in a day Streak

[@Lampe2020]

Yay, another video about the xz backdoor…

[@Llew70]

It's no different than being forced to not delay Microsoft "updates" beyond a certain point... Windows 10 has been around how long? And they are still finding vulnerabilities? FFS test your crap ahead of time (where it doesn't malfunction in the presentation). Allow us to remove Edge, Cortana, Game bar and other crap we don't use that eats up drive space. I have a potato laptop with a SS drive that is HALF filled with the operating system... I don't use more than half of that junk. Everything else I have to relegate to an external drive because Windows takes control. f them.

[@kolz4ever1980]

It would take a real developer from a real os like Windows to do the job for the devs of that bootleg Linux os. 😂

[@Twisted_Code]

I just want to point out that this video's use of XKCD 2347: dependency might be breaking the creative common's noncommercial license since you make money on KZbin. Hopefully Randall Munroe (a pretty respectable fellow IMO) wouldn't mind such a brief commercial use of the comic, but you should be more careful

[@LeeMaiden]

Bitdefender is good stuff, I have Win 10 on two desktops, but I'm usually on either machine using the main hard drive which one is Linux Mint's LMDE 6, and the other machine is Linux Mint's 21.3 Cinnamon. I have Bitdefender on my Mini PC that has Win 11 Pro on it, I have Bitdefender on my phone also, it's one I recommend to clients of mine also. It's a shame they don't make a version for Linux that would have caught this XZ problem. I rarely use Windows, so this one hit close to home hitting Linux with a well used tool.

[@Twisted_Code]

stuff like this is why I'm so serious about secure coding. Put as many self-checks in your software as possible. For example, something that might've protected against this attack: don't load libraries that don't match the checksum you expect. if that library that was used by SSH had been checked for integrity (which likely could have been done with libraries SSH was already using, since it's already doing some cryptography) this attack would have failed

[@aremoreequal]

The US Government has programmers. The Army has programmers. I almost went the programming rout when I joined up, but I went into a different MOS. They created America's Army, the game. The US Government (and other governments around the world) should be writing their own operating systems.

[@Calamity_Jack]

Code review seems to be an achilles heel for open source projects. On the face of it, the idea seems ironclad - all submitted code's there for everyone to scrutinize and understand before its committed to main. However... not every project has 100% diligent code reviewers. Most people are more concerned with getting their pet features and bug fixes in, not reviewing the code of others. Especially with somewhat obscure yet intrinisic apps like XZ. Plus, there's often no way to vet who is contributing code to the project. Anyone can play, even malicious actors.

[@G-3-A-R-Z]

Arch never linked the XZ library to SSH because they are not stupid. Also they came out with the fix removing it lightning fast. Fear must sell youtube. lol At least when Microsoft bros get the Idea to hate on Linux. The funny part is Windows has all this kinds of stuff in as a feature for the NSA. lol SO yeah. open source still better.

[@thesheep3077]

starts watching video, 'seems interesting', sees embedded ad that can't be skipped. Presses big red X to close window. YT'ers need to understand that embedding ads in their own videos is crippling their channel. Lots of viewers like me just stop watching at that point. When you prioritize revenue over message, you are a shill "Do not recommend channel" clicked

[@PeterMarszalkowski]

If you know how games used to be installed and you overload them so that they run and they were also write-protected and and and and had to take care of loading loading commands, interposing command cells and and you had to create a special software icon for that which pre-loaded you to start the game. It doesn't run on servers anymore, it shouldn't be online anymore, but you can if you overload it and they think everything is OK and we have the old driver and this shit runs, it runs in the background and otherwise the thing would be like a wall, you are safe as long as it is on they can't f***** each other and you can transfer everything. Maximum on a season ticket, well, you can give yourself rights and everything on, it means security, the old one is there, what do you want, remove x2 x4x4, you have to get it running otherwise do the system. Too fast is stupid, you. 50 x50 uhh, the files have to be huge, that's no use with a little more fan

[@NonstickMilk]

Not going to lie, but I was lost about a minute into the video because I know squat about computers. I just dig your videos because they always show up in my feed. Who knows, maybe I am slowly learning things. What would be the point of doing something that malicious? To put that much time and effort into something that destructive, there must have been something to gain, was it money? A form of terrorism? It’s sad that people with that kind of talent can’t do something good with it

[@troyBORG]

Old news. This was reported on like a month ago. Sleeping under a rock I see....

[@minerfinger6814]

Just because my detective brain in up due to watching T.V. I thought, wouldn't it be a good idea to check the original creator behind the program as well? These people went as far as to plan this much, just maybe he was in it all along too. P.S. Do not take this comment siriously.

[@wasd____]

Maybe packages that are being maintained by one burned out guy who only does it sporadically as a hobby and isn't consistently communicative or responsive should get phased out of use instead of kept as pieces of vital infrastructure. Just saying, there's a lesson here, and we're not learning it fast enough: when you create software people really depend on for important things, don't set yourself up for one random guy's old piece of software to be put into a multiplier-effect position where it can cause absolutely horrible consequences in a widespread manner.

[@kbcin7208]

This KZbin algorithm is much worse than previous algorithms because it showed me this video in suggestion feed after two days the upload day even after being subscribed. plz ignore my grammar mistakes (I got no degree in grammar; I practically hate it I mean I hate grammar not degree though I use fahrenheit.)

[@Reycko]

A backdoor in xz could be absolutely horrible

[@wasd____]

Maybe packages that are being maintained by one burned out guy who only does it sporadically as a hobby and isn't consistently communicative or responsive should get phased out of use instead of kept as pieces of vital infrastructure. Just saying. Don't set yourself up for one random guy's old piece of software to cause "absolutely horrible" consequences.

[@soulman902]

I saw this with another OSS project where Bitcoin mining was added to a library which was being used by a commercial project which was used by the company I used to work at. Our Anti-virus caught it being installed by the Dev and the company that put out the update had to release a new update.

[@JasonMitchellofcompsci]

I have an idea. Make all softwrre open source. Use AI to score how human readable all files are. If a file scores too poorly it isn't considered open source.. Open source projects are scored by how human readable their least human readable file is.. If everyone can read everything *easily* then things are more safe. So no. You may not have binary files on your github.

[@jirib.8280]

Both advantage and disaadvantage of open source software... in the end good. If it would be skillful programmer in company like Microsoft, the backdoor could have been there for years.

[@XDubio]

I heard about this vulerability. I think this only shows that even free (as in freedom) and opensource projects need to implement test suites that can capture these kind of attacks beforehand, unfortunately to maintain these is not a single person's task. IMO the solution here would be for more people to volunteer in these critical components, employees of other software companies with possible conflict of interest or not.

[@imSomebody-m4c]

Why does your throat look weird?

[@_SJ]

Adam's apple?

[@theunderstatement6842]

aponia pfp detected

[@TheGrinningViking]

It was the CIA - they try to do this all the time and have direct access to the companies and developers.

[@zenreeio13lIIIl]

What I wonder and want to discuss that I haven't seen anyone else mention is... will this break the trust for Linux? I already know of people that do not trust it, and honestly I'm starting to feel the same. I'm wondering what the general population thinks

[@SteltekOne]

1:45 Small nitpick: Debian's name is a contraction of Ian Murdock, the founder, and his then girlfriend Debra's name, so it's pronounced deb-ee-an, not dee-bee-an.

[@jamescomstock7299]

Just casually acts like every server on the internet uses Java. That said, this kind of supply chain attack showcases one of the biggest challenges of open source software, in my opinion.

[@bobtarmac1828]

The worst hack ever? Maybe. But with swell robotics everywhere, Ai jobloss is the only thing I worry about anymore. Anyone else feel the same? Should we cease Ai?

[@adamb7088]

This sounds like it could have been very widespread since Windows uses some Linux architecture as does OSX. (Please correct if I'm wrong.)

[@ca_kay]

This just further proves the attack on Flash was nonsense. The Heartbleed Bug, which had already been patched, is nothing compared to real backdoors.

[@MnasaNezbavis-x3b]

Hey, Can you make a video explaining the modded KZbin and Spotify apk? It's really fascinating in my opinion. Thanks.