We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·17d ago·5 min read
"Half a Second" - a book on the XZ backdoor
TL;DR
A Microsoft engineer discovered a backdoor in XZ Utils, a widely used compression tool, after noticing a half-second delay in login times. This hidden vulnerability, created over two years, highlights the risks associated with relying on under-resourced open-source projects.
✦ Why It Matters
Engineers should advocate for funding and support for critical open-source projects to enhance security and reliability.
Key Takeaways
- Regularly audit the open-source tools you use for vulnerabilities.
- Consider contributing to or funding critical open-source projects.
- Stay informed about security incidents in widely used software.
- Encourage your organization to support volunteer maintainers.
Full Summary
On March 29, 2024, a Microsoft engineer identified a half-second delay while logging into a test machine, leading to the discovery of a backdoor in XZ Utils, a compression tool integral to many Linux systems. This backdoor had been secretly integrated over two years, exploiting the vulnerabilities of open-source software maintained by a single, exhausted volunteer.
The narrative follows the engineer's curiosity, the manipulation of the volunteer, and the elusive identity of the attacker. While major companies support large software projects, many smaller, critical components rely on unpaid volunteers, creating a precarious balance in digital infrastructure.
This incident underscores the risks associated with underfunded open-source projects and the potential for hidden threats within widely used software.