TL;DR there was a backdoor found in the XZ program. All major distros have been updated but it is recommended that you do a fresh install on systems that are exposed to the internet and that had the bad version of the program. Only upstream distros were affected.

  • Possibly linux@lemmy.zipOP
    link
    fedilink
    English
    arrow-up
    7
    ·
    7 months ago

    Makes you wonder why Termux ships the latest stuff. It might be smart to allow more time for critical problems to get caught.

    • RvTV95XBeo@sh.itjust.works
      link
      fedilink
      arrow-up
      9
      ·
      edit-2
      7 months ago

      Probably for the exact same reason this backdoor was introduced. Users complain about slow feature rollouts so (unpaid) devs (maintaining software in their spare time out of the kindness of their hearts) cut corners. In some situations that looks like bringing on a second maintainer without thorough vetting, in others it looks like importing upstream packages without thorough vetting.

      Don’t blame the Termux devs here, blame the community that keeps pushing them to move faster.