Paper: “Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation”

"""
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. […] On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.
"""

https://arxiv.org/abs/2607.24888

Milestone achieved! For Debian Code Search, I no longer need to use cgo to link in the AVX2-optimized TurboPFor C library that powers our index since 2019: https://michael.stapelberg.ch/posts/2019-09-29-dcs-positional-turbopfor-index/

Instead, thanks to Go 1.27’s SIMD support, I can use AVX2 (and AVX512) natively from Go :)

Turns out that upstream C TurboPFor does not use AVX512 yet, so my Go implementation is now *faster* than C (for our use-case) 😲

So, as of today, Debian Code Search is running with CGO_ENABLED=0 (and GOEXPERIMENT=simd GOAMD64=v3) 🎉

A blog post with more details is in the works, if you’re curious. Let me know if you run into any bugs.

#golang #debian #simd

New blog post: Tracking down a Zsh history data loss bug 🐞

For many years, I sometimes discovered that commands I was sure I had run were no longer present in my Z shell history file (~/.zsh_history). In this article, I will show you how I tracked down the bug. Spoiler: ultimately, patching Zsh to make it crash loudly and analyzing the crash’s core dump was the winning strategy!

https://michael.stapelberg.ch/posts/2026-08-09-zsh-history-truncation-bug/

If you haven’t seen it:

> Bad Epoll (CVE-2026-46242) is a race-condition use-after-free in the #Linux kernel's epoll subsystem. This bug lets an unprivileged process become root, not only on Linux desktops and servers but also on Android devices.

https://github.com/J-jaeyoung/bad-epoll

Linux v7.1, v7.0.10+, v6.18.33+ are fixed (already running on my NixOS VMs, so I did not have to do any updates for this one)

I cannot relate. IPv6 has been on in my home network since ≈2010 and I can’t even remember the last time I encountered an IPv6-related bug.

But I guess statements like this is what Jeff means when he says “*Cosplaying* as a sysadmin”?

Because if you throw your hands in the air over IPv6 (in 2026!), you’re definitely not a sysadmin I would want to work with.

Average IP Version 😂

#gpn24

In case you missed it (and only saw the outrage), Tridge (https://en.wikipedia.org/wiki/Andrew_Tridgell) recently blogged about #rsync and the change in security vulnerability discoveries:
https://medium.com/@tridge60/rsync-and-outrage-d9849599e5a0

anonyme Selbsthilfegruppe für Menschen, die ihre Lohnarbeit auf Windows ausüben müssen

#gpn24

New blog post 🥳

How my minimal, memory-safe #golang rsync steers clear of vulnerabilities

Back in January 2025, multiple different security researchers published a total of 6 security vulnerabilities in rsync[…], so naturally I was wondering whether/how my gokrazy/rsync implementation was affected. Did implementing my own (compatible, but minimal) rsync in Go, a modern and memory-safe programming language, really rule out entire classes of security vulnerabilities?

→ https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/

Amazing: #Debian is now shipping reproducible packages 💪

https://lists.debian.org/debian-devel-announce/2026/05/msg00001.html

Thanks to everyone who helped make this happen!

See https://reproducible-builds.org/ if you are not familiar with the topic