Bonum Certa Men Certa

What the Media Overlooks in xz: Microsoft Staff 'Discovered' the Issue in a Microsoft Platform Just Before Easter and in Time to Distract From Exchange Blunder

posted by Roy Schestowitz on Mar 31, 2024

The more important news to watch today or this weekend: (it's still largely unresolved and it enables blackmail, political/industrial espionage, and further security breaches)

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

For many of the above servers, it's unequivocally a case of "too late". The E-mails (and beyond) got copied by hostile actors and the consequences remain to be seen for years to come. This can cause suicides and cost billions of euros/dollars in damages (over time).

Oh, forget about that!

Let's talk about the version of xz that's in Microsoft's GitHub.

Microsofters didn't invent a logo and a brand name for it this time around?

Well, we guess not. Or not yet.

So earlier on we made some remarks on the flaws that impacted mostly cutting-edge distros (which rush to adopt new and untested/unaudited stuff). We saw that before with OpenSSL and similarly security-sensitive packages, which distros typically adopt just months later (maturity required). We wrote some articles about it in 2021, rebutting the scare-mongering and hype/FUD. Microsofters played a big role in that FUD at the time. It happened again a year later (2022).

Now it's 2024. The facts still matter.

The media mostly credits Red Hat (regarding xz), but Red Hat was merely a respondent, and Red Hat formally complained about words like "backdoor" or logos and brand names being leveraged to hype up holes like "heartbleed" (which did not actually cause much damage, it just caused damage to the perception/image of Linux, owing to endless media hype that lasted many years).

As we explained at the time, and many times in fact, Microsofters were responsible to this hype campaign (even if the original discovery came from a Google employee).

So today it seems familiar. Why? Because the latest reports we've found make it clear that the disclosure came from Microsoft staff at a very strategic time (see screenshots above).

What Microsoft wants you not to notice (or resort to "whataboutism" when clients choose to move to GNU/Linux) is the stuff at the top.

Yes, Andres Freund works for Microsoft. It was not clear at first. He used his anarazel.de email instead of Microsoft email. Why?

What a timing to disclose his 'revelations' (a lot of this involves GitHub, not just systemd, which is led/run by Microsoft staff).

As noted above, Microsofters did the same with "heartbleed" over a decade ago. Because "Microsoft heart Linux".

So what exactly happened here? One can guess based on salient points of evidence.

Stockpiling holes for strategic times?

We debated this in length only a week ago in IRC because any time Microsoft has an epic security blunder the "Linux" news suddenly gets filled with FUD. And once again they're bombarding all "Linux" related news with alarming security-themed headlines (not so unprecedented a pattern). The Friday/Saturday news about "Linux" looked like this, and that's aside from the above. Pseudonymous reporters, who could even be on Microsoft's payroll, released some information about a hole just at the same time Microsoft had a lot of answering to do (and an emergency patch, which came far too late, as servers had already been breached, exposing perhaps trillions of emails, some of them very sensitive).

We need answers here. For instance, how long has Microsoft's Andres Freund known about this issue? Did someone give him a tip?

This man is in the business of selling Windows, not Linux, and at Microsoft security is never the objective. It is just another "product" or "add-on".

Other Recent Techrights' Posts

It's Easy to Snyk in Marketing SPAM (and FUD) Into BetaNews
The latest marketing piece (disguised as information, not shameless self-promotion)
GNU/Linux at 4% in Algeria
So it more than doubled since last year
[Meme] The Failure of Microsoft Rebranding Campaigns
market share down, costs soared, back to basics
Why Your Web Site Should Also Support HTTP (Without 'Secure')
sites which force everybody to use HTTPS have an inherent accessibility problem
Microsoft Windows is Technically at 0% in Some Countries
It's not an important platform to target anymore
Windows Measured at 5.7% 'Market Share' in Philippines, GNU/Linux Rose to 5%
It was 3.62% last month
statCounter: GNU/Linux Up to 4.6%, Windows Down Sharply This Month (Almost 22% Worldwide)
Let's see it the figures stay stable throughout the month
Figures of Note: Tesla's Debt Has More Than Doubled in Two Years and It's a Symptom of a Fake Economic Order
Cash infusions by taxpayers can create "billionaires" who aren't "job creators" (see what happened to Twitter) and bring no benefits to these taxpayers, only poverty
Linux Foundation Let Linux.com Rot for Two Months and Now It Posts Ridiculous Spam
Mindless shopping site
 
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, December 02, 2024
IRC logs for Monday, December 02, 2024
The L Word (Not Linux)
Championing Software Freedom is "dangerous"
Did IBM Layoffs Stop? Ask Dr. Krishna, The 'Genius' of IBM...
Trust AK to solve all the problems of IBM by creating bigger problems
[Meme] Sportwashing vs Code of Censorship (CoC)
Expectation of censorship (censor for me... or else!)
With 4 Weeks to Go (Before the End of 2024) the FSF Has Already Raised Close to 100,000 Dollars
The FSF must be doing something right
"Linux on the Desktop" (Less Than a Third of Web-connected Computers Still a Desktop or Laptop)
It's like we're chasing a goal that's 2 or 3 decades in the past
2 Years Have Passed Since ChatGPT Vapourware and Bing Gained Nothing, Yandex is About to Overtake Microsoft in Search
A cause for concern at Microsoft?
GNU/Linux Rises to 4% in Ireland, ChromeOS Grows and Android Takes Windows' Lunch
Windows down to 22%
[Meme] Meanwhile at Intel (Where the CEO Got the Boot)
Well, if taxpayers pay to save Intel, then Intel should be publicly owned (by those taxpayers)
A Cult of Fake Security
It's almost as if there's a coordinated effort to weed out and drive away people who are passionate about security for the users, as opposed to the financial security of companies like Google and Microsoft
Gemini Links 02/12/2024: Long Hair and Spirituality, Technology and Nature
Links for the day
Windows Not Even a 'Thing' Anymore... in North America (Where It Originally Came From)?
StatCounter shows Windows isn't even listed as a leading platform in any country in North America
Links 02/12/2024: Obesity Crisis to Worsen, Syrian Coups Rebound
Links for the day
Months After Mass Layoffs at Microsoft Nigeria Windows "Market Share" Collapses (Now Measured at 5%)
Of course the winner is Android (new all-time high of 77.3%)
South America Has Made It (Android Majority Everywhere) and in North America New Records for GNU/Linux Usage
Windows monopoly rents cannot be salvaged
Windows Down to Only One in Six Internet- or Web-Connected Devices in Asia
it's not looking good for Microsoft
Microsoft Windows Market Share in the United Kingdom Has Fallen to About 20%
Microsoft knows the true numbers, but it would rather not tell
Links 02/12/2024: Journalists Arrested, Tesla Factories Destroying the Planet and Public Health
Links for the day
Gemini Links 02/12/2024: Adventures With Bevy, Google Very Evil, Jumping Into Gemini
Links for the day
BetaNews is Still a Shrine of Microsoft, and Casually Also an LLM Slop Factory
Fake articles, anti-Linux FUD, and Microsoft propaganda make a sound "business model"?
[Meme] Cyber Monday is Not a Thing; There's No Such Thing (It's a Corporate SPAM Campaign Plaguing the Web)
Enough with these fake 'holidays' that billionaires (business oligarchs) keep inventing to make more money at other people's expense (debt)
Software Freedom Conservancy (SFC) and Linux Foundation: Same Mentality of Revisionism and Plunder
Lie about history and then 'cash in'
[Meme] Software Freedom Conservancy (SFC) Begs You for Donations
How does one even spend 20,000 dollars per month???
Why Software Freedom Conservancy Does Not Deserve Money (Karen Sandler is Already a Millionaire and Her Organisation Attacks Free Software Leaders)
These people speak for "Big Money" interests, not for freedom
On the internet [sic] (Lowercase), They Spread Misinformation About the Internet
Hugh Grant remembers what happened before he was born
Richard Stallman Was Getting Honorary Doctorates Almost Every Year Until 'Cancel Culture' Stepped in, Distracting From Jeffrey Epstein's Ties to Bill Gates
This finally ended... earlier this year (October)
Self-Deprecating Attacks on RMS
Drew DeVault seems to have deleted all of his social control media accounts
When Bills Are Rising, Whereas the Demand Isn't (OpenAI is Insolvent)
Latest month on record shows traffic fell about 3 times lower than earlier this year
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, December 01, 2024
IRC logs for Sunday, December 01, 2024
Links 02/12/2024: Climate, Sportwashing, and Software Patents
Links for the day
Gemini Links 02/12/2024: Words and Apologies, Being Rude, and Geminauts 0.1.0 Release
Links for the day
today's howtos
some older leftovers
The Microsoft OSI: All the Latest Blog Posts Are Written by Microsoft Operative Salaried by Microsoft
OSI is truly occupied. Microsoft more or less 'bought' the OSI...
Links 01/12/2024: Russian Police Raiding Gay Bars, Zelensky Wants NATO Membership
Links for the day
Gemini Links 01/12/2024: Recycling and Interest in Computers
Links for the day
Links 01/12/2024: 23andMe's DNA Bubble Imploded, Web Server Survey Shows Microsoft Nosediving
Links for the day
Vulture funds war-gaming Ireland loss of corporation tax revenue, Donald Trump
Reprinted with permission from Daniel Pocock
Gerry Hutch & Debian: suicide by Monk?
Reprinted with permission from Daniel Pocock
Gerry 'The Monk' Hutch: criminals vs geeks, multinationals vs Ireland
Reprinted with permission from Daniel Pocock
"Microsoft suffered the next largest loss, down by 634,406 sites (-3.24%)"
Microsoft is now in only 2 of the 5 tables; over time Microsoft slips out of visibility in more categories
The Post Offices Have Turned Into Trash. They Swallow Packages and Only Spit Them Out If You Get Lucky.
Nom nom nom
Four Years of Videos (Self-Hosted, Not Social Control Multimedia)
Seeing how the "hey hi" (AI) hype spreads to GulagTube and ruins GulagTube, we're glad we need not worry about Google (Gulag) policing our "content" via supposedly 'free' (not really) platforms, such as GulagTube, the social control (multi)media "market leader"
[Meme] Hiding From Bullies Not the Solution
‘The only thing necessary for the triumph [of evil] is for good men to do nothing.’
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, November 30, 2024
IRC logs for Saturday, November 30, 2024
If You Support Free - is in Freedom/Libre - Software, Then Support the Free Software Foundation (FSF)
2024 was the most productive year so far
CNN's Front Page is About 250 Times Heavier Than Techrights' (Also Far Slower)
Those who value performance and users' experience will give bloat the boot
[Meme] What 'Social Justice Warrior' Has Come to Mean by 2024
People who have long called themselves "SJW" aren't exactly any of those things
We Already Know What Makes Techrights So Attractive to Online Abuse and Cybercrimes
Techrights helps explain how to dismantle the 'cancel culture' against Free software (it also names the key perpetrators)
Microsoft Controlling Apache by Proxy/ies
This is a broader attack on what "Open Source" actually means