#security - April 2024

The open-source project owners who are experiencing mental health issues are the targets of social engineering

when this xz happened at the first time, I got a question on my mind, the English commit messages are so fluent, https://research.swtch.com/xz-timeline. Did the xz owner Lasse Collin talked to Jia Tan before, either face to face or voice? Did anyone know Lasse Collin or see him before? When did ssh include liblzma?

Another social engineering takeover attempt: https://therecord.media/researchers-stop-credible-takeover-xz-utils