From: Farley Flud <ff@linux.rocks>
Subject: Think You Got GNU/Linux Cred? Think Again.
Newsgroups: comp.os.linux.advocacy
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Lines: 26
Path: ...!weretis.net!feeder6.news.weretis.net!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!feeder.usenetexpress.com!tr2.iad1.usenetexpress.com!news.usenetexpress.com!not-for-mail
Date: Sat, 13 Apr 2024 21:21:02 +0000
Nntp-Posting-Date: Sat, 13 Apr 2024 21:21:02 +0000
X-Received-Bytes: 1136
X-Complaints-To: abuse@usenetexpress.com
Organization: UsenetExpress - www.usenetexpress.com
Message-Id: <17c5f3c54f7869da$3891$2854538$802601b3@news.usenetexpress.com>
Bytes: 1532

Think you got GNU.Linux cred?  Think again.

Bash is in many ways the lifeblood of a GNU/Linux system and
especially in its build system.  (How you gonna have a fucking
system if you can't fucking build?)

The legacy and still dominant GNU/Linux build system is Autotools:

https://en.wikipedia.org/wiki/GNU_Autotools


What follows is more on the infamous XZ backdoor.

The xz backdoor exploited autotools and bash in a brilliantly
obfuscated process to load a hidden maleficent payload.  The
details are here:

https://research.swtch.com/xz-script

The crux is that if you cannot follow the process then you
have absolutely no GNU/Linux cred.

All those who cannot follow should leave this group and never
return.  They are totally useless.