https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
Also in Suse Tumbleweed and other such rolling/testing distros.

On Sat, 30 Mar 2024 10:32:03 +0800, Ozix wrote:

> https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-
rawhide-users
> Also in Suse Tumbleweed and other such rolling/testing distros.

of course your likely safe if using a non systemd distro, slackware is
free of it because it doesnt use the virus worse then covid - systemd.

of course also the obvious...
always sign packages and their checksum files with a secure gpg key
d/l'rs always check the signing, checksums meh they only confirm your d/l
is complete, not like this mess an archiver psackage (xv) has been r00ted
especially if your distro packager :P

noel wrote:
> On Sat, 30 Mar 2024 10:32:03 +0800, Ozix wrote:
>
>> https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-
> rawhide-users
>> Also in Suse Tumbleweed and other such rolling/testing distros.
>
> of course your likely safe if using a non systemd distro, slackware is
> free of it because it doesnt use the virus worse then covid - systemd.
>
> of course also the obvious...
> always sign packages and their checksum files with a secure gpg key
> d/l'rs always check the signing, checksums meh they only confirm your d/l
> is complete, not like this mess an archiver psackage (xv) has been r00ted
> especially if your distro packager :P
>

xckd did a cartoon about about global digital infrastructure being
dependent on some code maintained by a single person:
https://xkcd.com/2347/

noel <deletethis@invalid.lan> wrote:
> On Sat, 30 Mar 2024 10:32:03 +0800, Ozix wrote:
>
>> https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-
> rawhide-users
>> Also in Suse Tumbleweed and other such rolling/testing distros.
>
> of course your likely safe if using a non systemd distro, slackware is
> free of it because it doesnt use the virus worse then covid - systemd.

Yes the SSH vulnerability only works a result of patches done by
distros for Systemd support in openSSH.

> of course also the obvious...
> always sign packages and their checksum files with a secure gpg key
> d/l'rs always check the signing, checksums meh they only confirm your d/l
> is complete, not like this mess an archiver psackage (xv) has been r00ted
> especially if your distro packager :P

True, but here it was a trusted developer of XZ Utils who put in
the backdoor code, and they actually had the key to sign releases
as authentic. So signed checksums can't help in a case like this.

--
__ __
#_ < |\| |< _#

On Sun, 31 Mar 2024 10:46:20 +1000, Computer Nerd Kev wrote:

>> always sign packages and their checksum files with a secure gpg key
>> d/l'rs always check the signing, checksums meh they only confirm your
>> d/l is complete, not like this mess an archiver psackage (xv) has been
>> r00ted especially if your distro packager :P
>
> True, but here it was a trusted developer of XZ Utils who put in the
> backdoor code, and they actually had the key to sign releases as
> authentic. So signed checksums can't help in a case like this.

Indeed, although that information was not available before I posted
that :)