2026-04-03 05:15 UTC
@IngaLovinde @aredridel
Are you describing CVE-2024-3094 ?
https://research.swtch.com/xz-timeline
Trusting long time contributors and not really reviewing their code is what got almost all Linux boxes pawned…
Replies (1)
-
@IngaLovinde@embracing.space 2026-04-03 08:48
@illogical_me @aredridel I'm not saying that you should not really review long time contributors code. I'm saying that regular _thorough_ review (and in my experience, what most people in corporate setting typically do is _way_ less than that) is nowhere near enough the kind of review that's needed to catch sophisticated adversaries. xz is a small project at least. But when you're working on a typical corporate project that has hundreds of lines changed per person per day, and not all people are good at reviewing even regular code: those who are good at reviews simply won't have enough time in the day to review all the code in "adversarial" mode with extra scrutiny.