<![CDATA[For the record, and since we are on the subject of supply-chain attacks:]]>For the record, and since we are on the subject of supply-chain attacks:

The person behind the 'daemontools' account on GitHub is unidentifiable, and certainly isn't Daniel J. Bernstein, me, @ska, Bruce Guenter, or anyone else well-known in the world.

The account has been inactive since 2013. If that account suddenly wakes up, it's not unreasonable to suspect that it has been compromised/become malicious.

(M. Guenter is bruceg on and is active there to this week.)

]]>https://board.circlewithadot.net/topic/3b2f43ab-debe-4a06-8bc6-00e9e1ecf9c8/for-the-record-and-since-we-are-on-the-subject-of-supply-chain-attacksRSS for NodeFri, 15 May 2026 07:38:02 GMTWed, 06 May 2026 06:42:28 GMT60<![CDATA[Reply to For the record, and since we are on the subject of supply-chain attacks: on Wed, 06 May 2026 17:26:56 GMT]]>@JdeBP @ska

It was my impression that the project that was backdoored was the Windows package Daemon Tools, which is unrelated to djb's daemontools. It's a CD/DVD/maybe floppy imaging program that can emulate having those virtual disks in a drive.

]]>https://board.circlewithadot.net/post/https://mindly.social/users/cazabon/statuses/116528802464508922https://board.circlewithadot.net/post/https://mindly.social/users/cazabon/statuses/116528802464508922Wed, 06 May 2026 17:26:56 GMT