Re: Malware find in the news: xz related.

On 3/31/24 11:26, Rich wrote:

But....  this is nearly a "Reflections on Trusting Trust" [1] level opsec.  attempt, and so just because BSD/Slackware/Gentoo happen to be immune this time, does not mean they would be immune to another opsec.  attempt against an OpenSSH direct dependency which might gain a similarly well hidden backdoor.

N.B. there is a big difference in saying that *BSD / Slackware / Gentoo (OpenRC) aren't effected by the topic at hand because they aren't using systemd and saying that they are obviously more secure because they aren't vulnerable to the topic at hand.
The former statement is probably relatively safe.  The latter statement is almost certainly unsafe.
--
Grant. . . .