Censorship News

[K-Dog]

'xz utils' software backdoor uncovered. 

Machines can be fully compromised, and the code could have eventually found itself onto this computer had it not been discovered.  A fascinating story.  The backdoor got into the widely used Debian Linux distribution (pre-release) branch, but not into the stable release.

What does this have to do with censorship?  The short answer is everything.  But a guy who wrote his own code so that Big Brother 'SHOULD' not have access to it, would find this to be a big deal.  And I do.  Funny this news is not mainstream.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that gives developers lossless compression. This package is commonly used for compressing release tarballs, software packages, kernel images, and initramfs images. It is very widely distributed, statistically your average Linux or macOS system will have it installed for convenience.

This backdoor is very indirect and only shows up when a few known specific criteria are met. Others may be yet discovered! However, this backdoor is at least triggerable by remote unprivileged systems connecting to public SSH ports. This has been seen in the wild where it gets activated by connections - resulting in performance issues, but we do not know yet what is required to bypass authentication (etc) with it.

We're reasonably sure the following things need to be true for your system to be vulnerable:

•     You need to be running a distro that uses glibc (for IFUNC)
•     You need to have versions 5.6.0 or 5.6.1 of xz or liblzma installed (xz-utils provides the library liblzma) - likely only true if running a rolling-release distro and updating religiously.

We know that the combination of systemd and patched openssh are vulnerable but pending further analysis of the payload, we cannot be certain that other configurations aren't.

While not scaremongering, it is important to be clear that at this stage, we got lucky, and there may well be other effects of the infected liblzma.

[K-Dog]

Since I went down the rabbit hole to find out about 'xz utils' I know who did it and how.  The details of that I did not post.  Since then I found a New York Times article about the backdoor.  (By way of Surly's newsletter)

The NYT article is a distortion.  The 'Thankless Guy from Nebraska' had in real life been helped by the individual who wrote the backdoor.  I don't want to hunt for the names just to prove a point.  The doer of the dirty deeds has a Chinese name.

The NYT article totally butchered the facts and have the 'Microsoft Engineer' who found the exploit as the 'Thankless Guy from Nebraska' which is a bogus buggery of actual facts.  The 'Thankless Guy from Nebraska'  is a victim who was used by the author of the backdoor.

And the real guy is not actually in Nebraska.  The cartoon has been around for years.  For all we know the Chinese perpetrator could have been an American alphabet agency.

And the NYT will be where the cover story will appear.

[K-Dog]

This is a good place to post this.

I put TDOS in the cooler.  I do not need his insults and deleted some of his posts.

As the owner of this website I will do with my personal property as I wish.  This is not to be confused with censorship.  Beyond simple trolling, TDOS was getting personal.  He developed a personal dislike for what he perceives as my success in life.  He considers me privileged.

I will have none of it.  I worked for 12 years working full time, and going to University part time to earn a bachelor degree.  I paid my way and had a family to take care of.  Later in life I earned a Maters degree.  No loans paid for either.  I paid along my way.  I really only made the 'big bucks' at the end of my professional career.

I am doing all right and I very much do appreciate what I have.  I could have nothing.  Many deserving people wind up with nothing.  I am still alive and in good health. 

But TDOS having a problem with me drawing social security and thinking of me as 'rich'?  This is too much.  Social security is earned by people who work.  It is not a handout.  And having a problem with me having retirement savings and driving a Mercedes Benz?

Yes, I could have none of it at all,  I could also have enough so I would not be unloading an 18-wheeler on Sunday when I am back at my part-time job.  I don't do it just to get out of the house.

I have it good, am I privileged?  If I am, I am someone who actually earned it.  And I won't tolerate insults.  TDOS is banned from posting for thirty days.

And while I pollute the atmosphere in style, I try to do it not so much.

[TDoS]

This is a good place to post this.

I put TDOS in the cooler.  I do not need his insults and deleted some of his posts.

As the owner of this website I will do with my personal property as I wish.  This is not to be confused with censorship.  Beyond simple trolling, TDOS was getting personal.  He developed a personal dislike for what he perceives as my success in life.  He considers me privileged.

While I get it that RE is a liar on occasion, I didn't figure that for you K-Dog. I was specific, RE had relayed information on how "privileged" you were and I referenced that when I said it. Read more carefully next time. And dislike your success? Please...on occasion I might think it would be cool to be Elon but just another run of the mill professional who worked and was born in the right time frame of US growth like me? Please. Play the economic victim all you'd like, doesn't bother me in the least.

I will have none of it.  I worked for 12 years working full time, and going to University part time to earn a bachelor degree.  I paid my way and had a family to take care of.  Later in life I earned a Maters degree.  No loans paid for either.  I paid along my way.  I really only made the 'big bucks' at the end of my professional career.

And I started off at the bottom in the oil field and according to RE became an industry professional consulted by companies, governments and named a world class geologist. So high up the professional food chain he can't have it mentioned on a website with 3 regular visitors without bruising his delicate ego. After all...he went to reel reel big HIGH SCHOOL where kids had DA MARTS! And then used his REEL BIG BRAIN to do....some stuff..... You can smell his jealousy for you, let alone those of us who motivated by poverty ran down the likes of entitled rich shits like that for sport the instant we hit college.

I am doing all right and I very much do appreciate what I have.  I could have nothing.  Many deserving people wind up with nothing.  I am still alive and in good health. 

Good for you. And now...you want a cookie?

But TDOS having a problem with me drawing social security and thinking of me as 'rich'?  This is too much. 

Too much only if you've left out using some brain cells and imagined words in my post where I was referencing anything other than RE's claims as to your economic level. Other than your two cars that in my world are designed to just scream status system they are meaningless to me. How long can you ride a wheelie on a motorcycle? What is your best lap time at Laguna Seca? Come close to mine on 2 wheels, I won't give any more a shit about your social status but you will become far more interesting and worthy of talking to. 

Social security is earned by people who work.  It is not a handout.  And having a problem with me having retirement savings and driving a Mercedes Benz?

Never said I had a problem with it. Anything else you want to fabricate on my behalf? Why should I have a problem with things I'm perfectly happy to have as well? Except for your cages, I've never given much of a shit about those. They need to run, be efficient, and not break down. 2 wheels are where you separate the men from the boys, cagers are just cagers regardless of socio-economic status.

I have it good, am I privileged?

Take a look at the other poster around here and you've got it damns good in comparison to him! Maybe that is why he was commenting on your pricey home and whatnot? You've got both legs, that alone puts you over the top in the privileged department compared to him.

If I am, I am someone who actually earned it.  And I won't tolerate insults.  TDOS is banned from posting for thirty days.

So then why haven't you? Because someone with your database skills who keeps erasing your own stuff as well as mine and then blames it on the MIB can't even figure out HOW?