• festus@lemmy.ca
    link
    fedilink
    English
    arrow-up
    34
    ·
    edit-2
    7 months ago

    They also believe we (Arch users) are unaffected because this backdoor targeted Debian and Redhat type packaging specifically and also relied on a certain SSH configuration Arch doesn’t use. To be honest while it’s nice to know we’re unaffected, it’s not at all comforting that had the exploiter targeted Arch they would have succeeded. Just yesterday I was talking to someone about how much I love rolling release distros and now I’m feeling insecure about it.

    More details here: https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/issues/2

    • tal@lemmy.today
      link
      fedilink
      English
      arrow-up
      7
      ·
      7 months ago

      Someone always has to be the guinea pig.

      That being said, maybe there’s an argument for distros that do rolling releases to have an “intentionally delayed rolling release” that just trails the regular rolling release by a fixed amount of time to provide more time for guinea pigs to run into things. If you want rolling, but can live with the delay, just use that.