I suspect this was just a lucky catch of shit that happens all the time. Supply chain attacks are super scary and effectively impossible to eliminate in modern software development.
Obviously not impossible to spot, just the best reason for open source software
It’s almost impossible to spot by people looking directly at the code. I’m honestly surprised this one was discovered at all. People are still trying to deconstruct this exploit to figure out how the RCE worked.
And supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.
There are sysadmins that discover a major vulnerabilities though troubleshooting
The key is the number of people involved
So, Microsoft saved everyone from the bad Linux then?
/s
“Linux saved itself.”
- having FOSS code
- being able to silence all system services to detect that bump
- being able to run stuff in different ways, without a core system component (with and without systemd, as that backdoor only used data when sshd was started via systemd)
- having people be perfectionist about performance measurements
- having devs test upstream code not shipped to normal distros
- being so good microsoft pays people to work on software for it
Yeah no Microsoft saved it
A nerd who was benchmarking their ssh connection saved it…I love everything about that fello
A
nerdA specialist
