Timeline for Why has my upvoted answer about xz been silently deleted?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 13 at 2:49 | comment | added | kos | @vidarlo You make a good point. I donwvoted that answer as well. However that answer is more problematic than the answer we're questioning here, as it brings also useful (or rather "not contested") advice, unlike OP's answer. So it's not black nor white, and it's harder to take a stance on it. It doesn't fully deserve deletion IMO. Although I don't like it at all because of the "run the binary" option. For sure, being a mod has to feel like walking on a razor's edge all the time. | |
| Apr 11 at 6:17 | comment | added | vidarlo | Especially given that another answer suggests to run the same commands. I can not see any reason why this answer was deleted. In this case running the commands is the simplest way to check... | |
| Apr 11 at 3:57 | comment | added | user unknown |
… My answer was a specific answer to the question on hand, not a general advice how to handle other, vague similar issues - malware, which isn't a carefully hidden open source backdoor. Here: xeiaso.net/notes/2024/xz-vuln is a page where the author issued the command on a vulnerable system and the output has been xz (XZ Utils) 5.6.1 \n liblzma 5.6.1 (Backslash n inserted by me), so with this command, it seems, you would get a correct feedback that your system is infected, if it was. Therefore I beg you to revoke the deletion of my post.
|
|
| Apr 11 at 3:50 | comment | added | user unknown |
When referring to the program in question as malware, you're ignoring that we have more specific information. It is part of a backdoor which has been carefully developed and hidden and is known to work in combination with SSH on Linux when the later is managed by systemd. You may speculate on secondary flaws, but that doesn't look reasonable to me, especially not in a simple function like version, where non trivial changes would have been obvious. The second issue I have with your answer is, that you widen the scope to these kinds of answers, then it sets a bad security precedent. …
|
|
| Apr 10 at 18:31 | comment | added | BeastOfCaerbannog | @ThomasWard if an answer does answer the question but you (everyone) disagree with it, it should be downvoted. If there is a concern of setting a bad precedent about a specific type of answers, a meta post explaining this concern should be made so that the community can know about it and decide how to act on such answers. This answer getting single-handedly deleted by a mod without at least leaving a comment explaining the deletion reason to the OP is an extreme and authoritative measure. | |
| Apr 10 at 14:57 | comment | added | Thomas Ward Mod | @terdon in the case of this specific vulnerability you're right, however the problem is if we start allowing these kinds of answers, then it sets a bad security precedent. Either way, I wouldn't suggest running anything that has any RCE vulnerability or backdoor vulnerability, even if there's even remotely a chance of a compromise. The point is that it's an insecure practice regardless, not specific to this vulnerability but to many in general. | |
| Apr 10 at 11:10 | comment | added | terdon |
Would that be dangerous though? From what little I understand, the backdoor is in liblzma not in the xz executable per se, so loads of programs, most notably sshd which apparently calls liblzma functions for its integration with systemd, can trigger it. If you do have the compromised liblzma on your system, then you're already pretty much screwed, right? Surely some compressed files are handled even during boot. So executing xz doesn't seem like it would increase the risk. Am I wrong?
|
|
| Apr 10 at 2:28 | history | edited | Thomas WardMod | CC BY-SA 4.0 |
added 293 characters in body
|
| Apr 10 at 2:19 | history | answered | Thomas WardMod | CC BY-SA 4.0 |