Post #2691583
2025-12-02 21:06 UTC
@GrapheneOS@grapheneos.social @globcoco@mamot.fr @Uddelhexe@mastodon.online
> Even with reproducible builds + open source, the source code can be written in a way which deliberately masks a vulnerability in subtle ways.
This is what happened Easter 2024 with zx library in ssh.
Replies (1)
-
@GrapheneOS@grapheneos.social 2025-12-02 21:14
@plumeros@swiss.social @globcoco@mamot.fr @Uddelhexe@mastodon.online If the xz backdoor had been written better without a severe performance issue, then it wouldn't have been caught in the way that it was. It was caught because of horrible performance causing issues on a server which a Microsoft engineer investigated. No one spotted it based on the source code despite being present there.