Bonum Certa Men Certa

What the Media Overlooks in xz: Microsoft Staff 'Discovered' the Issue in a Microsoft Platform Just Before Easter and in Time to Distract From Exchange Blunder

posted by Roy Schestowitz on Mar 31, 2024

The more important news to watch today or this weekend: (it's still largely unresolved and it enables blackmail, political/industrial espionage, and further security breaches)

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

Microsoft Exchange chaos example

For many of the above servers, it's unequivocally a case of "too late". The E-mails (and beyond) got copied by hostile actors and the consequences remain to be seen for years to come. This can cause suicides and cost billions of euros/dollars in damages (over time).

Oh, forget about that!

Let's talk about the version of xz that's in Microsoft's GitHub.

Microsofters didn't invent a logo and a brand name for it this time around?

Well, we guess not. Or not yet.

So earlier on we made some remarks on the flaws that impacted mostly cutting-edge distros (which rush to adopt new and untested/unaudited stuff). We saw that before with OpenSSL and similarly security-sensitive packages, which distros typically adopt just months later (maturity required). We wrote some articles about it in 2021, rebutting the scare-mongering and hype/FUD. Microsofters played a big role in that FUD at the time. It happened again a year later (2022).

Now it's 2024. The facts still matter.

The media mostly credits Red Hat (regarding xz), but Red Hat was merely a respondent, and Red Hat formally complained about words like "backdoor" or logos and brand names being leveraged to hype up holes like "heartbleed" (which did not actually cause much damage, it just caused damage to the perception/image of Linux, owing to endless media hype that lasted many years).

As we explained at the time, and many times in fact, Microsofters were responsible to this hype campaign (even if the original discovery came from a Google employee).

So today it seems familiar. Why? Because the latest reports we've found make it clear that the disclosure came from Microsoft staff at a very strategic time (see screenshots above).

What Microsoft wants you not to notice (or resort to "whataboutism" when clients choose to move to GNU/Linux) is the stuff at the top.

Yes, Andres Freund works for Microsoft. It was not clear at first. He used his anarazel.de email instead of Microsoft email. Why?

What a timing to disclose his 'revelations' (a lot of this involves GitHub, not just systemd, which is led/run by Microsoft staff).

As noted above, Microsofters did the same with "heartbleed" over a decade ago. Because "Microsoft heart Linux".

So what exactly happened here? One can guess based on salient points of evidence.

Stockpiling holes for strategic times?

We debated this in length only a week ago in IRC because any time Microsoft has an epic security blunder the "Linux" news suddenly gets filled with FUD. And once again they're bombarding all "Linux" related news with alarming security-themed headlines (not so unprecedented a pattern). The Friday/Saturday news about "Linux" looked like this, and that's aside from the above. Pseudonymous reporters, who could even be on Microsoft's payroll, released some information about a hole just at the same time Microsoft had a lot of answering to do (and an emergency patch, which came far too late, as servers had already been breached, exposing perhaps trillions of emails, some of them very sensitive).

We need answers here. For instance, how long has Microsoft's Andres Freund known about this issue? Did someone give him a tip?

This man is in the business of selling Windows, not Linux, and at Microsoft security is never the objective. It is just another "product" or "add-on".

Other Recent Techrights' Posts

Techrights Does Not Compete With LLM Slop, It Exposes the Bastards, Plagiarists and Scammers Who Do That
People like Scam Altman, still facing a lawsuit from his own sister for sexual abuse against her
Slopwatch: Planet Ubuntu Became LLM Slop and Some People Fail to See the Immorality of Plagiarism
it lessens the incentive for people to publish real articles
Microsoft Layoffs Again in Bay Area
Microsoft relies on people's false belief that being "in LinkedIn" will get you a job; well, seems like even working inside LinkedIn really sucks and you lose the job
 
The "AI" (Slop) Bubble Already Popped, But It's Not an Overnight Collapse
where Microsoft put its money
No More Steven Astorino at IBM, Chatter About Weekly/Nonstop Layoffs at IBM
What happened? Good luck guessing.
Looking at Corruption in Europe, Going Beyond the EPO
Expect a new series to kick off very soon
Slopwatch: Security SPAM and LLM Slop for SEO and FUD Purposes, Perpetually Tarnishing the Perception of Linux and (Open)SSH Security
A lot of this Fear, Uncertainty, Doubt (FUD) comes from Microsoft and its LLMs
Links 30/05/2025: Google's LLM Slop Pushers Are Killing Journalism and Shira Perlmutter Fails to Stop Bribed Regime From Legalising Plagiarism (in "AI" Clothing)
Links for the day
Links 30/05/2025: Offline Arts and "Threshold of Patience"
Links for the day
Signing Off Serious Lies With a Statement of Truth is No Joking Matter
It's not hard to see what's happening here
Links 30/05/2025: LLM Slop Already Ingests and Vomits Its Own Garbage, Facebook Exec Admits Copyrights a Concern Too
Links for the day
Mass Layoffs at Microsoft Result in More Whistleblowers From Microsoft
Microsoft's predatory pricing is further
EPO Poll: 68% Dissatisfied With Quality of Slop (Wrongly Framed as "AI") for Patent Classification
Slop does not work, it's just falsely advertised with extra hype (funded by slop pushers that sponsor the major media)
Big Crowds Gather to Learn About Software Freedom From the Man Who Started GNU/Linux in 1983
"It was a great success"
Gemini Links 30/05/2025: Fighting Against the Bad News, and Slop is Dehumanisation Disguised as "Intelligence"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, May 29, 2025
IRC logs for Thursday, May 29, 2025
Links 29/05/2025: Chinese Cracking Against EU Institutions (Prague), More Assaults on Media and Its Funding Sources
Links for the day
EPO Workers Caution That the Officials Are Still Illegally Trying to Replace Staff With Slop (to Lower Quality and Validity of European Patents)
Nobody in Europe voted for any of this
Links 29/05/2025: US Health Deficit and Malware Disguised as Slop Generator
Links for the day
Links 29/05/2025: Turtle Roadkill, Modern 'Tech' as a Sting
Links for the day
Thanks for All the Fish, Linux Format
people who once wrote for it (or for other magazines) comment on the importance of this news
People's Understanding of the History of GNU/Linux is Changing
RMS is not a radical, he's just clever enough to see and foresee what's going on
Microsofters Were Scheming to Take Over This Entire Web Site (in Their Own Words!)
Money gets spent censoring/deplatforming people who speak about real issues; no money gets spent actually tackling those underlying issues
Bicycles for the Minds and the Story Harrison Bergeron
"The goal of having people in charge of the tools they use and that the tools should amplify ability" has long been abandoned
Links 29/05/2025: YouTube Problem and Giant Privacy Hole in Microsoft OneDrive
Links for the day
[Video] Cory Doctorow Explains DMCA: DRM in the Browser (or Webapp) Will "Make It a Felony to Protect Your Privacy While You Use It."
Pycon US Keynote Speaker Cory Doctorow
United States Courts With Sworn Testimonies Are on Our Side, We'll Present the Same Here
Chronicling what happened is a moral imperative
Serial Sloppers Ruin and Lessen the Incentive to Cover "Linux"
The Serial Sloppers (SSs) ought to be named and shamed, but almost nobody does this
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, May 28, 2025
IRC logs for Wednesday, May 28, 2025
Links 28/05/2025: 'Emulation Layers' (Measurements and Linguistics), Libraries, and Discomfort
Links for the day
Links 28/05/2025: More Arrests for Bitcoin-Connected Torture and Prosecutions for Dieselgate-Linked Executives
Links for the day
Even Microsoft (MSN) Covers Richard Stallman's Public Talk in Milan 2 Days Ago
He spoke in Spanish earlier this month (Alicante)
Gemini Links 28/05/2025: Techo-authoritarianism With Slop Plagiarism and "No Online June" (Going Offline)
Links for the day
Links 28/05/2025: GitHub MCP Exploited and MathWorks Discovers Huge Windows TCO
Links for the day
Very High Attendance Level at Richard Stallman's Talk Shows People Can Relate to His Message
Smear campaigns have their limits
Gemini Links 28/05/2025: Celsius-Fahrenheit, Endless Scrolling/Infinite Scrolling, and Trapping LLM Slop Bots
Links for the day
Prison gate backdrop to baptism by Fr Sean O'Connell, St Paul's, Coburg
Reprinted with permission from Daniel Pocock
More Photos From This Week's Milan Talk by Richard Stallman
The posts are in Italian, not English
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, May 27, 2025
IRC logs for Tuesday, May 27, 2025