news
Debian: Proxmox VE, Colin Watson, and Otto Kekäläinen:
-
Rui Carmo ☛ Proxmox VE - Tao of Mac
Proxmox Virtual Environment is a Debian-based system that focuses on providing enterprise-grade LXC and KVM management capabilities, and that I have been using for my homelab.
-
Chiark ☛ Colin Watson: Mistaken dichotomies about dgit
In “Could the XZ backdoor have been detected with better Git and Debian packaging practices?”, Otto contrasts “git-buildpackage managed git repositories” with “dgit managed repositories”, saying that “the dgit managed repositories cannot incorporate the upstream git history and are thus less useful for auditing the full software supply-chain in git”.
-
Otto Kekäläinen: Could the XZ backdoor have been detected with better Git and Debian packaging practices?
The discovery of a backdoor in XZ Utils in the spring of 2024 shocked the open source community, raising critical questions about software supply chain security. This post explores whether better Debian packaging practices could have detected this threat, offering a guide to auditing packages and suggesting future improvements.