A Book About the XZ Utils Backdoor Has Been Released: “Half a Second”

Adrian Mastronardi has published a book titled “Half a Second” — a detailed account of the 2024 attempt to plant a backdoor in the XZ Utils library. The book is available for free and is distributed under a Creative Commons license that permits non-commercial use but prohibits the creation of derivative works.

The author frames the story as a single narrative built around three central figures. The first is a burned-out volunteer who single-handedly maintained the project's codebase, and whom the attacker patiently and skillfully nudged into handing over control of its maintenance. The second is an engineer whose fleeting curiosity — lasting quite literally half a second — made it possible to spot the signs of the attack, thanks to a coincidence of circumstances and hard-earned intuition. The third figure is the attack's operator, whose identity was never established; the book's author contends that it may never be uncovered.

The XZ Utils backdoor remains one of the most widely discussed incidents in the open-source software community in recent years, because it laid bare the vulnerability of a model in which critically important projects are maintained by one or a handful of volunteers. Mastronardi's book offers a coherent account of events — from the social engineering used to gain access to the project's maintenance to the chance discovery of the tampering — that had previously been scattered across many separate reports, posts, and technical breakdowns.

The emergence of such an extended narrative may serve not only as a historical document but also as material for discussing how open-source communities can protect themselves from similar attacks in the future.

Source: LWN.net