• psmgx@lemmy.world
    link
    fedilink
    arrow-up
    37
    arrow-down
    12
    ·
    7 months ago

    You’re late to the party NYT.

    Also, dude made a good save. Only arch users got hit lol

    • DumbAceDragon@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      31
      ·
      edit-2
      7 months ago
      1. The hack mainly targeted Debian and fedora

      2. Arch doesn’t directly link openssh to liblzma, so the hack doesn’t affect arch users.

      • Revan343@lemmy.ca
        link
        fedilink
        arrow-up
        7
        ·
        7 months ago

        The hack mainly targeted Debian and fedora

        But on Debian it only shipped on sid. This is the reason for Debians slow as fuck release cycle

    • qaz@lemmy.world
      link
      fedilink
      arrow-up
      26
      ·
      7 months ago

      Arch didn’t patch it with systemd so it didn’t really affect them afaik. It did hit OpenSUSE Tumbleweed users.

    • Disonantezko@lemmy.sdf.org
      link
      fedilink
      arrow-up
      26
      ·
      7 months ago

      Do you know the exploit was detected in Debian Sid? (by a PostgreSQL developer), Arch got the update (with both compromised versions), but because don’t directly link openssh to liblzma (as Debian), and thus this attack vector is not possible.

      Also, other rolling distros also got the compromised versions, maybe: openSUSE Tumbleweed, Endeavour OS, Fedora Rawhide, Slackware -current, etc.

    • seaQueue@lemmy.world
      link
      fedilink
      arrow-up
      6
      ·
      7 months ago

      There was some checking in the exploit to verify that it was being built for a deb or rpm package, it didn’t build for anything else. Also, the way the exploit was loaded at runtime relied on features of systemd that Arch isn’t using. It was a dud on Arch.

      • Possibly linux@lemmy.zip
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        8
        ·
        edit-2
        7 months ago

        And how many people actually use those? Arch got hit the hardest

        Ok that’s a bad joke. The exploit targeted Debian, Ubuntu and RHEL