TPS

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Edit: originally posted here on 2023-11-17.

Edit 2: "blocking protecting marginalised community members from abuse" refers to the events during the incident (which was never made public, which unfortunately leaves me unable to provide more detail) that prompted the creation of the Community Council to begin with.

Edit 3: please note that this statement was originally addressed to the F-Droid team, not a general audience.

Leaving F-Droid

With a heavy heart, I have no choice but to leave @fdroid, effective immediately.

preface: Posting these online since it sounds like these notes are somewhat interesting based on a few folks I've shared with. These are semi-rough notes that I basically wrote for myself in case I ever needed to revisit this fix, so keep that in mind.

I recently bought an LG ULTRAGEAR monitor secondhand off of a coworker. I really love it and it's been great so far, but I ran into some minor issues with it in Linux. It works great on both Mac and Windows, but on Linux it displays just a black panel until I use the second monitor to go in and reduce the refresh rate down to 60 Hz.

This has worked decent so far but there's some issues:

It doesn't work while linux is booting up. The motherboards boot sequence is visible just fine, but as soon as control is handed over to Linux and I'd normally see a splash screen while I'm waiting for my login window, I see nothing.
It doesn't work on the login screen. This would be fine if login consistently worked on my second screen, but I need to manually switch

#	Test	Command	8.0.0	PATCH
1	zlib, o6	oxipng -o 6 -i 0 --out 01_oxi_normal.png t.png	48290731	45277379
2	same, interlaced	oxipng -o 6 -i 1 --out 02_oxi_normal_interlaced.png t.png	50144548	50144548
3	max zlib	oxipng --zc 12 -o max -i 0 -a --out 03_zc12_b.png t.png	48290731	45277379
4	Zopfli	oxipng -Z -o 6 -i 0 --out 03_oxi_normal_ZOPFLI.png t.png	47883283	47883283

Comparison of output file size for example images processed with oxipng. Comparing libdeflater 0.11.0 and 0.13.0

	#!/bin/bash

	# Retrieve the list of packages
	packages=$(adb shell pm list packages \| sed 's/package://')

	# Convert the packages to an array
	IFS=$'\n' read -d '' -r -a package_array <<< "$packages"

	total_packages=${#package_array[@]}

	~/playground/Signal-Android$ docker run --rm -v $(pwd):/project -w /project signal-android ./gradlew clean assemblePlayProdRelease
	Downloading https://services.gradle.org/distributions/gradle-8.0.2-all.zip
	...............10%................20%................30%................40%................50%................60%................70%................80%................90%................100%

	Welcome to Gradle 8.0.2!

	Here are the highlights of this release:
	- Improvements to the Kotlin DSL
	- Fine-grained parallelism from the first build with configuration cache
	- Configurable Gradle user home cache cleanup

	#!/usr/bin/env python3
	# -- coding: utf-8 --
	#
	# Minimal script to check whether a JPEG-XL file contains JPEG
	# lossless reconstruction data, in a more robust way than
	# grepping the output of jxlinfo.
	#
	# This parses the ISO BMFF structure directly, so has no dependencies.
	#
	# Usage:

	# Copyright: (c) 2023, Jordan Borean (@jborean93) <[email protected]>
	# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

	#Requires -Module Ctypes

	Function New-S4UAccessToken {
	<#
	.SYNOPSIS
	Generates an S4U access token.

	# Explanation

	PNGQuant: `pngquant --quality 100-100 --speed 1 --strip`

	OxiPNG: `oxipng --opt max --strip all --alpha`

	OxiPNG-ZF: `oxipng --opt max --strip all --alpha --zopfli`

	Oxi-Quant: "PNGQuant" > "OxiPNG" (non-ZF)

	$ ./adb shell pm list package

	package:android.framework.res.overlay.domestic
	package:com.oppo.instant.local.service
	package:com.oplus.framework_bluetooth.overlay
	package:com.coloros.karaoke
	package:com.qti.phone
	package:com.oplus.atlas
	package:com.android.modulemetadata
	package:com.android.connectivity.resources