[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Mar 2024 15:11:56 +0100
From: Marcin Wolcendorf <antymat@...lmska.waw.pl>
To: oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to
ssh server compromise
On Sat, Mar 30, 2024 at 09:34:45AM -0400, Marc Deslauriers wrote:
> On 2024-03-29 22:48, Tavis Ormandy wrote:
> > On 2024-03-30, Marc Deslauriers wrote:
> >
> > Sure - but why do you have to do that in private? You can get everyone
> > to help get those answers and converge on the correct solution
> > quickly.
> >
> > The attackers already knew about this issue, so you were just keeping it
> > from defenders... that doesn't make sense to me.
>
> I'll let you in on a little secret: malicious entities also read this list.
>
> There is no way to discuss this in public without turning a single malicious
> entity into 10 000 malicious entities once the information is widely known.
>
> Making sure the impact and mitigations are known before posting this
> publicly so that everyone knows what to do before the 10 000 malicious
> entities start attacking is just common sense.
I'll let you in on a little secret, too: bad actors talk to each other! They
exchange information about the exploits. So you already *potentially have*
10000 of them trying to exploit the vulnerability, with the most of the
affected people being none-the-wiser.
I'd rather know, so I can do something to avoid or repair the damage, instead
of figuring out my systems might have been compromised for weeks. If you want
to sit in the dark - feel free, just don't take me with you.
M.
--
.... *** System shutdown message from root ***
System going down in 60 seconds
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
