xvlc
joined 2 years ago
Simply excluding this backdoor does not seem to be sufficient. The malicious actor has contributed over 750 commits to xz, all of which could contain further backdoors.
Downgrading to the last version without any contributions from the malicious actor is not possible either, because of new functionalities and other security issues that were fixed in the meantime. Uninstalling xz is also not possible, because half my system depends on it.
I guess it will take some time to sort all of that out. I am very impressed by the fast and coordinated response to this incident by the FOSS community.
view more: next ›
I assume JAXA ordered a fixed number of HTVs, those were built and then the construction line was closed down, probably before 2018. Just ordering another one was probably not possible.