Developers say open-source software culture, where users demand constant updates from volunteer coders, is a security issue, as shown by the XZ Utils backdoor
A previously unknown contributor to the popular open-source Android app store F-Droid repeatedly pressured its developers to push … Mastodon: @samleecole@journa.host , @doctormo@floss.social , and @mhoye@mastodon.social X: @davidgerard , @iethics , @emanuelmaiberg , @samleecole , @iethics , @jbhall56 , @jason_koebler , and @josephfcox . Forums: r/Android Mastodon: Sam Cole / @samleecole@journa.host : open source is at a point where it's hard to determine whether a pushy contributor is just being a dick or is a malicious actor trying to insert vulnerabilities... and that's a big problem https://www.404media.co/... @doctormo@floss.social : I've known some A grade security-holes in my time. Community management, codes of conduct and moderation are the #infosec tools of #socsec — https://www.404media.co/... #coc #foss #oss #xz @mhoye@mastodon.social : Specifically, I bet that these “somebody almost got away with that” stories happen _all the time_ and they get buried inside the companies, communities or other organizations around open source software because of how embarrassing it can be to admit how close we came to screwing up something important in the work we take pride in, and for the people who depend on us. … X: @davidgerard : https://www.404media.co/... tolerating huge fucking assholes in tech is a security attack surface @iethics : “In this case, the vulnerability ultimately wasn't pushed to a live product, but it's a very specific example of the types of pressures and culture that #opensource projects are constantly dealing with”: https://www.404media.co/... #ethics #internet #cybersec #tech Emanuel Maiberg / @emanuelmaiberg : I wonder how many more of these we're going to find! https://www.404media.co/... Samantha Cole / @samleecole : open source is at a point where it's hard to determine whether a pushy contributor is just being a dick or is a malicious actor trying to insert vulnerabilities... and that's a big problem https://www.404media.co/... @iethics : A “very similar situation nearly led F-Droid to push an update that would have introduced a security vulnerability into the product three years ago... ‘In the end, it became clear that it added a SQL injection vulnerability’”: https://www.404media.co/... #ethics #cybersec #tech Jeff Hall / @jbhall56 : In the case of the Xz backdoor, a malicious actor was able to pressure the owner of a widely-used Linux compression utility called Xz Utils into making them a trusted maintainer of the project. https://www.404media.co/... Jason Koebler / @jason_koebler : Bullying in open source software is a massive security risk, as shown by the Xz backdoor, a near-miss at F-Droid, and as repeatedly pointed out by people trying to change the culture of FOSS over the years: https://www.404media.co/... Joseph Cox / @josephfcox : Entitlement as a security issue—"The Xz backdoor and a near miss on the F-Droid app store show how the entitled attitude of some people in the open source community can be used to push malicious or insecure code." https://www.404media.co/... Forums: r/Android : “Three years ago, F-Droid had a similar kind of ‘bullying’ attempt as the Xz backdoor,” a longtime developer of F-Droid reports Expand More For Next Unexpand More For Next
Context & Ripple Effects
The XZ Utils incident turns maintainer trust into a supply-chain security concern: a malicious actor reportedly gained standing through sustained pressure before attempting to introduce a backdoor. The account also identifies a near-miss at F-Droid, where an update that could have added a SQL-injection flaw was not released.
The story sits alongside an older dispute over cloud firms commercializing open-source projects through services built on others’ open-source work, highlighting a persistent mismatch between broad reliance on shared code and the resources available to govern it.
First-order effects
- Maintainers of projects such as F-Droid face greater pressure to treat persistent contributor demands and requests for faster releases as security-relevant signals, not merely community friction.
- Users and downstream adopters must rely on tighter review of changes to trusted utilities after the XZ attempt showed how maintainer access can become the route to compromise.
Second-order effects
- Open-source projects may slow releases or narrow who can gain commit-level trust, trading some contributor convenience for stronger review and provenance controls.
- Organizations that consume widely used volunteer-maintained components have a clearer incentive to support maintainer review and release security, rather than treating upstream maintenance as a free input.
Third-order effects
- If similar incidents persist, software supply-chain defense will increasingly center on the social process of establishing maintainer trust, alongside code scanning and vulnerability response.
- The underlying governance challenge is durable: heavily depended-on projects may need more sustainable stewardship models, or their small maintainer groups remain a concentrated trusted-maintainer risk.
The trend: Open-source security is shifting from a focus on defects in code toward governance of the people, access, and release processes that determine what code becomes trusted infrastructure.