Conversation

Notices

1. AndresFreundTec (andresfreundtec@mastodon.social)'s status on Monday, 08-Apr-2024 23:23:44 UTC AndresFreundTec

   I accidentally found a security issue while benchmarking postgres changes.

   If you run debian testing, unstable or some other more "bleeding edge" distribution, I strongly recommend upgrading ASAP.

   https://www.openwall.com/lists/oss-security/2024/03/29/4

   • gokuldas (gokuldas@mastodon.social)'s status on Monday, 08-Apr-2024 23:23:43 UTC gokuldas

     in reply to

     @AndresFreundTec "... and kids, that's how i saved the world"

     Santa Claes 🇸🇪🇭🇰🎅 likes this.
   • AndresFreundTec (andresfreundtec@mastodon.social)'s status on Monday, 08-Apr-2024 23:23:44 UTC AndresFreundTec

     in reply to

     I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates.

     Really required a lot of coincidences.

   • Gordon Messmer (gordonmessmer@fosstodon.org)'s status on Monday, 08-Apr-2024 23:23:46 UTC Gordon Messmer

     in reply to

     @AndresFreundTec Thank you so much for finding this!

     The questions at the top of my mind now are: who will fork and continue maintenance of xz? How will we determine that we can trust them? And how will we apply those lessons throughout the larger ecosystem?

     Santa Claes 🇸🇪🇭🇰🎅 likes this.
   • Gordon Messmer (gordonmessmer@fosstodon.org)'s status on Monday, 08-Apr-2024 23:23:47 UTC Gordon Messmer

     in reply to

     • malte

     @malte @AndresFreundTec There's still a lot of data out there already in xz format, so merely dropping the software would mean that that data becomes unreadable. Dropping it may be an option, but I'm not sure it's the best option.

     Santa Claes 🇸🇪🇭🇰🎅 likes this.
   • malte@anticapitalist.party's status on Monday, 08-Apr-2024 23:23:48 UTC malte

     in reply to

     • Gordon Messmer

     @gordonmessmer @AndresFreundTec i read that many projects migrate to zstd anyway ¯\_(ツ)_/¯