c/linux · by KarnaSubarna@lemmy.ml · 2yUbuntu 24.04 Beta Delayed Due To XZ Nightmare https://www.phoronix.com/news/Ubuntu-24.04-Beta-Delayed26 points · 7 comments · view on lemmy.world
7 Comments
rotopenguin@infosec.pub · 10 pts · 2y
My $0.05 reading of it is that they want to hose down the build servers* and start clean, in case if the attacker escaped the sandboxing there.
* (the computers that compile all of the new packages from source, not web servers that are handing out finished deb binaries to the public.)
style99@kbin.social · 8 pts · 2y
They're rebuilding all the newer builds "out of an abundance of caution." The servers themselves obviously don't run on experimental software.
rollingflower@lemmy.kde.social · 4 pts · 2y
This.
rollingflower@lemmy.kde.social · 1 pts · 2y
They dont run experimental software on their build servers.
avidamoeba@lemmy.ca · 1 pts · 2y
That would make sense if they ran servers on non-LTS release. Do they do that?
KarnaSubarna@lemmy.ml · 2 pts · 2y
Further read: https://discourse.ubuntu.com/t/xz-liblzma-security-update-post-2/43801?u=d0od
DieserTypMatthias@lemmy.ml · -3 pts · 2y
Just don't package it. And if you have to, sandbox it in Firejail or in Bubblewrap. Or just make Snap out of it.