Hacker News Reader

There is an interesting argument to be made that pre-JT xz code is probably pretty secure due to the fact that the threat actors would have already audited the code for existing exploits prior to exerting effort to subvert it.

I always use "zstd --long=31 -T0 -19" to compress disk images, since that is a usecase where it generally offers vastly superior compression to xz, deduplicating across bigger distances.

XZ offers slightly better compression on average, but decompression is far slower than Zstd.

IIRC memory consumption is generally worse for Zstd at comparable levels of compression. Which, these days, is generally fine, but my point is you can't thoughtlessly substitute the two.

What keeps ringing in my head is the "." that was found that invalidates compilation. I personally don't buy it (but is my opinion).

What do you mean "don't buy it"?

My bad. I thought that the person who made that commit was someone else than JT. Can't delete comment nor self-down-vote it.