Ömer Aydın omeraydindev

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

A compile-time 4-Bit Virtual Machine implemented in TypeScript's type system. Capable of running a sample 'FizzBuzz' program.

Syntax emits zero JavaScript.

type RESULT = VM<
  [
    ["push", N_1],         // 1
    ["push", False],       // 2
 ["peek", _], // 3

Using an Access Token for the first time

Follow the instructions on Github to Create an Access Token in Github

Configure Git to use the osxkeychain

By default, git credentials are not cached so you need to tell Git if you want to avoid having to provide them each time Github requires you to authenticate. On Mac, Git comes with an “osxkeychain” mode, which caches credentials in the secure keychain that’s attached to your system account.

You can tell Git you want to store credentials in the osxkeychain by running the following:-

	#!/bin/bash

	# Function to display usage information
	usage() {
	echo "Usage: $0 /path/to/input.mp4 [ /path/to/output_directory ]"
	exit 1
	}

	# Check if at least one argument (input file) is provided
	if [ $# -lt 1 ]; then

	// Use like this: node --import logger.js yourapp.js

	import path from 'path';

	const { log } = console;
	[`debug`, `log`, `warn`, `error`, `table`, `dir`].forEach((methodName) => {
	const originalLoggingMethod = console[methodName];
	console[methodName] = (...args) => {
	const originalPrepareStackTrace = Error.prepareStackTrace;
	Error.prepareStackTrace = (_, stack) => stack;