It’s almost impossible to spot by people looking directly at the code. I’m honestly surprised this one was discovered at all. People are still trying to deconstruct this exploit to figure out how the RCE worked.

And supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.

People are still trying to deconstruct this exploit to figure out how the RCE worked.

True, but we do know how it got into xz in the first place. Human error and bad practice, we wouldn’t have to reverse engineer the exploit if xz didn’t allow binary commits all together. It’s a very convoluted exploit with hiding “junk” and using awk and other commands to cut around that junk and combining it creating a payload and executing it. Our reliance on binary blobs is a double edged sword.

supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.

Also true, because human error is impossible to snuff out completely, however it can be reduced if companies donated to the projects they use. For example, Microsoft depends on XZ and doesn’t donate them anything. It’s free as in freedom not cost. Foss devs aren’t suppliers, it comes as is. If you want improvements in the software your massive company relies on, then donate, otherwise don’t expect anything, they aren’t your slaves.