Untitled attachment

Notices where this attachment appears

1. Matt Hamilton (eriner@noauthority.social)'s status on Saturday, 30-Mar-2024 09:34:51 JST Matt Hamilton

   in reply to

   Guy has Go project that wraps xz to provide native Go bindings. Project has had no commits for THREE YEARS.

   Suddenly some guy sends a PR to update the version of xz in use to the backdoored version:
   https://github.com/jamespfennell/xz/pull/2

   Then you got some guy in the HN comments astroturfing everyone claiming that he knows the guy who submitted the PR IRL and he's a "cool dude", or something.

   All this shit is so sus.

   CAN THE FUCKING FEDS PLEASE STOP BACKDOORING OPEN SOURCE SOFTWARE PLEASE? K THANKS