this post was submitted on 29 Mar 2024
672 points (99.3% liked)
Technology
57435 readers
4091 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Shots fired!
It seems WSL Ubuntu and Kali are safe with versions 5.2.5 and 5.4.4 installed respectfully.
Damn, I installed mine disrespectful.
Is that when you install it in a VM, as if to show it that it’s not a good enough little distro to boot directly on your hardware?
I suddenly feel so guilty!
I thought about the same (disrespectful) as I typed it. I've already laughed with you!
Don't forget about openSUSE Tumbleweed! It's actually affected AFAIK.
I think the AI that wrote the article misunderstood.
Arch doesn't build from release tar balls, but straight from git. Arch also doesn't link sshd against liblzma. So while they've shipped the dirty version of xz utils, at least sshd is not affected.
It's possible that the dirty version affected some of the other things that link liblzma. Like a handful of kde components for example.
The linked article is by Dan Goodin from Ars Technica. He's not immune to mistakes, but he's been writing good articles about security for years.
Can we please not accuse everybody of being AI just because they made a mistake?
Suspicious. /s
Well, he's credited as the editor overseeing security stuff. Reading between the lines I'd say he's just taking responsibility for the articles correctness.
This article in particular is just so poorly written that you'd forgive me for assuming it wasn't man-written.
Also, the malicious code only activated if it detected being built as dpkg or rpm.