thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

skade

    let mut changeset = BlogRepository::change().inserts::<Posts>();

    for id in 1..=3 {
        let post = Post { id: id, content: format!("Post number {}", id) };

        changeset.push(post);
    }

    let mut changeset = changeset.inserts::<Comments>();

swalkinshaw

Moved to Shopify/graphql-design-tutorial

chronon

Possible values for ext-name:

bcmath
bz2
calendar
ctype
curl
dba
dom
enchant

kevincennis

Installing V8 on a Mac

Prerequisites

• Install Xcode (Avaliable on the Mac App Store)
• Install Xcode Command Line Tools (Preferences > Downloads)
• Install depot_tools
  • $ git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git
  • $ nano ~/.zshrc
  • Add path=('/path/to/depot_tools' $path)

ceejbot

#!/usr/bin/env node

var fs = require('fs'),
    https = require('https');

// We pass our client key & cert to the http agent,
// which we then use to make the request.
var agentOptions = {
	key: fs.readFileSync('client.key'),
	cert: fs.readFileSync('client.crt'),