For the record, and since we are on the subject of supply-chain attacks:

[jdebp@tty0.social]

For the record, and since we are on the subject of supply-chain attacks:

The person behind the 'daemontools' account on GitHub is unidentifiable, and certainly isn't Daniel J. Bernstein, me, @ska, Bruce Guenter, or anyone else well-known in the #daemontools world.

The account has been inactive since 2013. If that account suddenly wakes up, it's not unreasonable to suspect that it has been compromised/become malicious.

(M. Guenter is bruceg on #GitHub and is active there to this week.)

[cazabon@mindly.social]

@JdeBP @ska

It was my impression that the project that was backdoored was the Windows package Daemon Tools, which is unrelated to djb's daemontools. It's a CD/DVD/maybe floppy imaging program that can emulate having those virtual disks in a drive.