Skip to content

Comment on Ask HN: ELI5 the Xz Attack/Vulnparent

Comments

"It is used by a fairly large number of other programs, one of which is OpenSSH. "

Not exactly. OpenSSH does not use xz. From the original report:

"openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma."

True but irrelevant. I left out a lot of irrelevant details, because I was aiming for a simple explanation (if not quite one truly suited for a five–year–old).

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.