1vuio0pswjnm7 on Ask HN: ELI5 the Xz Attack/Vuln

Comment on Ask HN: ELI5 the Xz Attack/Vuln parent

A nice example of why cannot trust "explanations" by HN commenters.

"It is used by a fairly large number of other programs, one of which is OpenSSH." <-- This is false

Have a look:

https://ftp.OpenBSD.org/pub/OpenBSD/OpenSSH/portable/openssh...

If a person compiles sshd from source using above source code, then there is no vulnerability. OpenSSH does not use xz/liblzma.

    wget https://ftp.OpenBSD.org/pub/OpenBSD/OpenSSH/portable/openssh-9.7p1.tar.gz
    tar xzf openssh-9.7p1.tar.gz
    cd openssh-9.7p1
    ./configure
    make install

Beware HN commenters/voters making false statements (and even trying to defend them against true statements).

Comments