I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere
XZ is a slog to compress and decompress but compresses a bit smaller than zstd.
zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format.
Lasse is the original maintainer of XZ, they have been placed back in their position as sole maintainer.
“Jia Tan” was the person who slipped the backdoor into XZ and is now banned.
Lasse has already fixed abd removed the backdoor.
XZ itself is critical software everyone uses (its one of the main compression/decompression programs used on linux)
Yes but damage seems to be done. Distros are talking or have moved off of it to zstd.
There are some, probably. But any exodus will be slow. Xz isn’t useless because it was dangerous once.
Besides, XZ isn’t the only project in such a danger. Banning doesn’t solve that problem. They need to put in more funding and eyes.
I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere
Zstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know.
XZ is a slog to compress and decompress but compresses a bit smaller than zstd.
zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format.