Miracle · March 29 2024

The Miracle of the 500 Milliseconds

The wonder

In early 2024 Andres Freund, a Microsoft engineer and PostgreSQL developer, noticed on Debian sid that SSH logins were taking about 500 milliseconds too long and that valgrind was reporting odd errors. Instead of shrugging it off, he followed the thread to a backdoor hidden in xz/liblzma 5.6.0 and 5.6.1, planted by 'Jia Tan' after a years-long social-engineering campaign against the project. On 29 March 2024 he disclosed it on the oss-security list: the backdoor was stopped just before it reached the stable releases of major Linux distributions.

The miracle worker

Andres Freund, whose curiosity about half a second too many protected a vast number of servers, together with the distribution maintainers who pulled the compromised packages within hours.

Thanksgiving

For half a second that didn't add up, and for the one who kept asking why, we give thanks. And for tired, lonely maintainers, we ask help and company. Amen.