How to pronounce“xz”in English

- I'm using XZ quite a lot.

I think XZ is a wonderful project.

Lasse released XZ in 2009, and over the next decade and a half, it went from a niche tool to the common choice

The code for XZ lives on a website called GitHub, which tracks all edits to XZ's code using a tool called Git,

Rich adds the updated XZ to a pre-release version of Fedora.

- We put XZ, this version, 560, into Fedora 40.

- And the backdoor in XZ specifically is generating invalid writes errors.

And he's identified Lasse Collin's XZ project as a weak link in the Linux ecosystem, one that could give him access to almost every computer on the internet.

But with a Trojan horse inside of XZ, it's still just a lump of data in a binary blob.

But now that it's inside of XZ, it still has to pick the right time to act.

And then it ended up on this Xzibit record.

And it just so happens that Lasse Collin's compression tool XZ is linked through a chain of these dependencies.

So, XZ quietly spread everywhere, eventually becoming a dependency of OpenSSH.

And since RSA Decrypt doesn't belong to XZ, it can't use an IFUNC resolver to override it.

All he needs to do now is get his updated XZ implemented in the next release.

- So we downloaded Jia Tan's version of XZ, which was available on Fedora publicly, but we made a slight modification.

Like I played on it-- you guys know Xzibit?

Now, Lasse's original goal with XZ was to find a better way to compress data on Linux.

He's got all these new features in the new version of XZ.

Lasse took this elegant compression algorithm and made it work on Linux, and he called it XZ not because it stood for anything,

Audit hooks are normally configured by the system, not by libraries like XZ.

He becomes frantic, pushing harder and harder to get his compromised XZ into major Linux releases.

Of course. Yeah, I played on an Xzibit record from my apartment.

No, Lasse Collin is from Finland, and he's been working on a small data compression tool called XZ since 2005.

- But across Linux, projects are constantly shipping the same files and updates to millions of machines, so XZ is perfect.

It hides among all the automatically generated code and quietly unpacks his payload, inserting it into the XZ library.

But just as Jia is completing his backdoor, an open source developer requests to remove the dependency that links XZ to OpenSSH.

Over the next few weeks, he gets more and more insistent, urging Rich to add the updated XZ into the next release of Fedora.

If you look at just the spatial parts, gxx, xy, xz, et cetera, those are what going to tell you the length of curves