On: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

[guenthert]

Or is it rather like someone posting a video on youtube on how to pick a common lock?

And what's about the fellows of U of Minnesota?

[tempay → guenthert]

It’s more analogous to getting hired at the lock company and sabotaging the locks you assemble to be trivially pickible if you know the right trick.

The University of Minnesota case is an interesting one to compare to. I could imagine them being criminally liable but being given a lenient punishment. I wonder if the law will end up being amended to better cover this, if it isn’t already explicitly illegal.

[brokenmachine → tempay]

What happened at the University of Minnesota?

[tempay → brokenmachine]

They intentionally tried to contribute security bugs into the linux kernel as a research project: https://lwn.net/Articles/854645/