• rtxn@lemmy.worldM
    link
    fedilink
    arrow-up
    25
    ·
    3 months ago

    That’s assuming the attacker is stupid enough to put the exploit in the source code where it can be easily discovered.

    The Xz exploit was not present in the source code.

    It was hidden in the makefile as an obfuscated string and injected into the object file during the build process.

    • haui@lemmy.giftedmc.com
      link
      fedilink
      arrow-up
      12
      arrow-down
      3
      ·
      3 months ago

      I saw the code. It was pretty obvious once you look at that particular piece. You have to adapt the makefile pretty often so you also would see gibberish. If you’re a programmer and you encounter what YOU think is gibberish, all alarms go off.

      i dont know your experience in coding but I dont see how a huge number (a given with old and popular code) of experienced people could overlook something like this.