If you disable it you can prevent Microsoft from force updating your windows 10 install to windows 11. Obviously a play to get people to buy new hardware for 11 but a useful anti feature I suppose until you can stomach switching to Linux.

I imagine if this attacker wasn’t in a rush to get the backdoor into the upcoming Debian and Fedora stable releases he would have been able to notice and correct the increased CPU usage tell and remain undetected.

I think ideas about prevention should be more concerned with the social engineering aspect of this attack. The code itself is certainly cleverly hidden, but any bad actor who gains the kind of access as Jia did could likely pull off something similar without duplicating their specific method or technique.

as long as you’re up to date on everything here: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

the only additional thing i’ve seen noted is a possibilty that they were using Arch based on investigation of the tarball that they provided to distro maintainers

I don’t foresee anyone with the kind of data needed to do more investigation releasing it to the public, so I doubt we’re going to be getting any satisfying answers to this. Microsoft may have an internal team combing through github logs, but if they find anything they’re unlikely to be sharing it with anyone but law enforcement agencies.

we know about the singapore VPN because they connected to IRC on libera chat with it. the only reason I can think people would believe they’re from hong kong is because of the pseudonym they used, but it’s not like that proves anything.

see link posted in another user’s reply: https://boehs.org/node/everything-i-know-about-the-xz-backdoor#irc

he was using a singapore VPN and had access to multiple sockpuppets. we know literally nothing else about them and anything you’ve heard to the contrary is baseless rumor.

leading theory is that it was a state-sponsored actor, but frankly even that much is speculation and which state is still way up in the air.

if you feel comfortable mucking about in your BIOS, disabling TPM will pretty much guarantee they don’t spring 11 on you. they are really dead set on that requirement for some reason.

i also remember having the cube around the same time in OSX somehow but I forget the method

deleted by creator

just having a couple brands and models to look into is pretty helpful. I know i’m sick to death of massive screens with touchscreen buttons for everything. i drive my step mother’s recent model BMW sometimes and trying to just change the radio station is a chore that involves clicking accept on a screen with a huge disclaimer warning you not to get distracted by the touchscreen while driving before you can even operate it.

Plenty of new cars don’t have an obnoxious infotainment screen as well.

maybe list them for OP instead of hinting at their existence.

a single button makes the clicks sound warmer.

Yeah I don’t disagree, cans would be better than bottles. I just wanted to point out that plastic is ubiquitous and shows up in a lot of places you don’t expect. It’s extremely difficult to completely eliminate it. I’m not arguing that progress toward that goal is pointless, just that the goalpost is a lot further away than you might expect.

Yeah I made the comment before seeing all those. Which is why I deleted it shortly after posting it. Is it still showing up?

deleted by creator

deleted by creator

Edge, unlike Internet Explorer, is not a system level dependency. There is a separately installed web view that handles that now, likely due to EU consumer protections.

People who treat driving as some kind of competition should have their license permanently revoked.

Well those do seem to be the arch Linux logos he’s arranged around a hexagon to make a Star of David in those thumbnails