{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Oxide and Friends","title":"Discovering the XZ Backdoor with Andres Freund","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/e2538f7d\"></iframe>","width":"100%","height":180,"duration":5837,"description":"Andres Freund joined Bryan and Adam to talk about his discovery of the xz backdoor. It’s an incredible story… so great to get into the details with Andres. We started by ranting about the coverage in the New York Times… coverage that explicitly refused to dig into the details! It’s all the more shocking because the big story here is how Andres’ penchant for digging into the details is what saved us all from what would have been a pervasive and damaging attack!\nIn addition to Bryan Cantrill and Adam Leventhal, we were joined by special guest Andres Freund.\nOur research for this episode:\nAndres' initial public disclosure\nNew York Times: Did One Guy Just Stop a Huge Cyberattack? by Kevin Roose\nKevin Roose\nNew York Times front page from April 4th, 2024\nHow I got started as a developer with Andres Freund & Heikki Linnakangas | Path To Citus Con Ep08\nThe Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind | WIRED\nHow one volunteer stopped a backdoor from exposing Linux systems worldwide - The Verge\nLinux backdoor was a long con, possibly with nation-state support, experts say - Nextgov/FCW\nresearch!rsc: Timeline of the xz open source attack\nBrian Krebs thread on mastodon\nXz/liblzma: Bash-stage Obfuscation Explained\nA Microcosm of the interactions in Open Source projects\nRisky Business #743 -- A chat about the xz backdoor with the guy who found it (podcast)\nRisky Biz News: F-Droid narrowly avoided XZ-like incident in 2020 (podcast)\nWhat we know about the xz Utils backdoor that almost infected the world | Ars Technica\nEverything I know about the XZ backdoor\nLINUX Unplugged 556: The xz Backdoor Exposed 🚨 (podcast)\nIf we got something wrong or missed something, please file a PR! Our next show will likely be on Monday at 5p Pacific Time on our Discord server; stay tuned to our Mastodon feeds for details, or subscribe to this calendar. We'd love to have you join us, as we always love to hear from new speakers!\nRecorded April 8th, 2024","thumbnail_url":"https://img.transistorcdn.com/cVYTzMGAZ_7gNn2i7iJYSuWlQOM4wHdJAzEuWrnLo9A/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS80OGI3/NjA5NWY4Yjc4NzE0/ZGI5ZmMzZmY4MjFi/YThiYy5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}