@jmm@fosstodon.org

· 5mo ago

Replying to

@LabanSkoller @alexanderkjall if they say so, they are lying. The distros security list wasn't notified and there was no headsup to Debian outside of the list either. And Ubuntu surely neither, otherwise they wouldn't have just pushed a patched kmod package with the module blacklisted...

14

2

1

0

Moritz Mühlenhoff @jmm@fosstodon.org

· 4mo ago

Replying to

@hellma@troet.cafe @bagder@mastodon.social Wireshark includes over 2100 dissectors for basically every network packet/protocol that has ever been in use (all written in C). That only 40 came up after massive AI-assisted analysis is testament to their solid development process, not a worry.

2

0

Moritz Mühlenhoff @jmm@fosstodon.org

· 4mo ago

Deutsche Bahn IT is really trying to mimic the splendid quality of their rail service. This is the error I'm getting trying to buy train tickets from a standard Firefox 140.10.2 browser with no other plugins than the KDE Plasma support, using a standard residential DSL IP address from Germany's largest ISP for over 30 hours now. And I've even logged into my bahn.de account, FFS.

1

0

1

0

Moritz Mühlenhoff @jmm@fosstodon.org

· 30mo ago

Replying to

@corbet I don't think the Debian maintenance state was relevant here. The malicious releases equally landed in other distros and the attacker e.g. pushed for pulling 5.6.1 to Ubuntu noble. In fact the last upload prior to the security revert officially changed the maintainer field to what was already the defacto xz maintainer in Debian: https://tracker.debian.org/news/1515323/accepted-xz-utils-561-1-source-into-unstable/

tracker.debian.org

3

0