The xz attack shell script(research.swtch.com)

553 points by todsacerdoti 2 years ago | 279 comments

Russ Cox blog post analyzing the shell script portion of the 2024 xz/liblzma backdoor, explaining how it injected malicious code into the build.

Linux Kernel Exploitation: Attack of the Vsock(hoefler.dev)

223 points by todsacerdoti 1 year ago | 65 comments

The long life of Apache httpd 2.4(utcc.utoronto.ca)

156 points by ingve 3 years ago | 121 comments

Some thoughts on OpenSSH 9.8's PerSourcePenalties feature(utcc.utoronto.ca)

62 points by jandeboevrie 2 years ago | 60 comments

Timeline to remove DSA support in OpenSSH(lists.mindrot.org)

239 points by throw0101d 2 years ago | 143 comments

OpenSSH 9.5 released with keystroke timing obfuscation(lwn.net)

199 points by surteen 3 years ago | 41 comments

Open Social(overreacted.io)

882 points by knowtheory 1 year ago | 353 comments

Dan Abramov's overreacted blog post arguing that social media should follow open source's path, built on open protocols like AT Protocol.

Open Source is one person(opensourcesecurity.io)

325 points by LawnGnome 1 year ago | 132 comments

Blog post by Josh Bressers on Open Source Security arguing that many open source projects are maintained by a single person.

A supply chain attack on PyTorch(johnstawinski.com)

444 points by roblabla 2 years ago | 92 comments

Blog post by John Stawinski describing how his team executed a critical supply chain attack on PyTorch via its GitHub Actions CI infrastructure.

Open Source as We Know It Is Dead(jross.me)

34 points by vinhnx 20 days ago | 13 comments

A personal essay by a self-taught developer reflecting on growing up with open source and GitHub and arguing that open source as we know it is dead.

New Linux udisks flaw lets attackers get root on major Linux distros(bleepingcomputer.com)

336 points by smig0 1 year ago | 227 comments

BleepingComputer news article about a udisks vulnerability that lets attackers gain root privileges on major Linux distributions.

Open source security at Astral(astral.sh)

344 points by vinhnx 6 months ago | 95 comments

Astral blog post by William Woodruff describing the techniques Astral uses to secure its open source tools and their build, test, and release processes against supply chain attacks.