Security Researchers Find XZ Utils Backdoored Debian Images on Docker Hub

Comments (2)

notherhack · 7h ago

"The Debian development team put it like this: So, given the wafer thin vectors of attack here, the extreme age of the images in question, and the fact that even at the time that they were fresh, they were images that shouldn't be used in production anyhow (Debian's "development" repositories), we've opted to leave them in place.

Binarly kind of agrees ... "

daymanstep · 5h ago

Good to know that the Debian team's attitude towards security has not materially changed since the OpenSSL fiasco.

GPT-5 (openai.com)

Fight Chat Control (fightchatcontrol.eu)

GitHub is no longer independent at Microsoft after CEO resignation (theverge.com)

I tried every todo app and ended up with a .txt file (al3rez.com)

Claude Sonnet 4 now supports 1M tokens of context (anthropic.com)

Ultrathin business card runs a fluid simulation (github.com)

I want everything local – Building my offline AI workspace (instavm.io)

Wikipedia loses challenge against Online Safety Act (bbc.com)

Streaming services are driving viewers back to piracy (theguardian.com)

FFmpeg 8.0 adds Whisper support (code.ffmpeg.org)

Emailing a one-time code is worse than passwords (blog.danielh.cc)

Debian 13 “Trixie” (debian.org)

Steve Wozniak: Life to me was never about accomplishment, but about happiness (yro.slashdot.org)

Vibechart (vibechart.net)

Claude Code is all you need (dwyer.co.za)

VC-backed company just killed my EU trademark for a small OSS project

Why LLMs can't really build software (zed.dev)

Gemma 3 270M: Compact model for hyper-efficient AI (developers.googleblog.com)

Nginx introduces native support for ACME protocol (blog.nginx.org)

Show HN: The current sky at your approximate location, as a CSS gradient (sky.dlazaro.ca)

Claude says “You're absolutely right!” about everything (github.com)

PYX: The next step in Python packaging (astral.sh)

Good system design (seangoedecke.com)

Open hardware desktop 3D printing is dead? (josefprusa.com)

How I code with AI on a budget/free (wuu73.org)

Show HN: Building a web search engine from scratch with 3B neural embeddings (blog.wilsonl.in)

Try and (ygdp.yale.edu)

This website is for humans (localghost.dev)

GPT-5: Key characteristics, pricing and system card (simonwillison.net)

Wikimedia Foundation Challenges UK Online Safety Act Regulations (wikimediafoundation.org)

OpenFreeMap survived 100k requests per second (blog.hyperknot.com)

I accidentally became PureGym’s unofficial Apple Wallet developer (drobinin.com)

Jim Lovell, Apollo 13 commander, has died (nasa.gov)

Search all text in New York City (alltext.nyc)

Ask HN: How can ChatGPT serve 700M users when I can't run one GPT-4 locally?

What's the strongest AI model you can train on a laptop in five minutes? (seangoedecke.com)

Historical Tech Tree (historicaltechtree.com)

Why are there so many rationalist cults? (asteriskmag.com)

Meta Leaks Part 1: Israel and Meta (archive.org)

The future of large files in Git is Git (tylercipriani.com)

Cursed Knowledge (immich.app)

The Chrome VRP Panel has decided to award $250k for this report (issues.chromium.org)

Monero appears to be in the midst of a successful 51% attack (twitter.com)

The Framework Desktop is a beast (world.hey.com)

GPT-OSS vs. Qwen3 and a detailed look how things evolved since GPT-2 (magazine.sebastianraschka.com)

Flipper Zero dark web firmware bypasses rolling code security (rtl-sdr.com)

Getting good results from Claude Code (dzombak.com)

Occult books digitized and put online by Amsterdam’s Ritman Library (openculture.com)

StarDict sends X11 clipboard to remote servers (lwn.net)

AI is different (antirez.com)

Security Researchers Find XZ Utils Backdoored Debian Images on Docker Hub

Comments (2)