Re: Malware find in the news: xz related.

On 4/1/24 03:47, Marco Moock wrote:

I can understand that, but this is the only really secure variant.

Nuke it from orbit is the only thing to have a fairly certain guarantee.   Everything else has a modicum of risk.  It's a personal / institutional choice if that risk is worth the cost of nuking from orbit or not.

Although, it is a serious threat because it somebody recorded passwords you typed or got secret keys, all of those machines can be compromised now.

Not necessarily.
Best practice dictates that you only allow keys to be used from known locations.
So even if the SSH key / certificate is compromised there is no guarantee that it will work.
Best practice also dictates that keys are protected with a pass phrase, ostensibly a good pass phrase.

Although, it can't help against disclosure and that means passwords and keys MAY be known to others now.

That's why I explicitly separated disclosing and alteration.
--
Grant. . . .