Hacker News Reader

> it's too early to claim that a project is not vulnerable to backdoors

I don’t think that’s a fair or accurate paraphrase of the blogpost.

They said they weren’t exposed to the backdoor (headline), or this issue (body of article). Both are deliberately singular, and from context clearly referencing the known back door.

I don’t see anything in the post claiming they aren’t vulnerable to back doors in general.

View on HN

That's my first point though. If you only take into account what is currently known about the backdoor, unless you are a linux distro building a liblzma debian or RPM package, you are not vulnerable to the backdoor.

So I believe, given the current state of knowledge, that all the projects that are not about building liblzma packages are not vulnerable and thus their postings about them not being vulnerable is noise.

Much like PyPI, there are a large number of gems on RubyGems that either vendor library builds or provide source redistributions for local builds. That’s why these kinds of indices need to perform these scans; it’s not sufficient to assume that the host distribution or OS is the only source of runtime libraries.

Sure, I wasn't disagreeing with your first point. I was disagreeing with your second point.

Reply on news.ycombinator.com