⬇ Download holy card: ·
☀ Commemorated today: The Miracle of the 500 Milliseconds (2024)Saint xzorcist, Who Cast Out the Backdoor
Patron of open source libraries, over-helpful contributors, and those who eye benchmarks with suspicion.
Life
On 29 March 2024 Andres Freund announced CVE-2024-3094: a backdoor had been hidden in the source of the xz compression library, starting from 5.6.0. Through a chain of obfuscations, the build extracted an object file from a fake test file and altered liblzma, opening a door in SSH access. It had been introduced, over years of patience, by a trusted contributor; it was found by chance, after noticing a few milliseconds too many.
Prayer
O Saint xzorcist, who casts the backdoor out of the possessed library, give us eyes to see the evil hidden in trusted code. Amen.
How to celebrate
Celebrated by reverting to a clean version of xz, verifying the supply chain, and thanking whoever notices the milliseconds too many.
An over-helpful contributor is code to read twice.