HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
tukaani-project
xz
C2024–2024
tukaani-project / xz

xz

XZ Utils

31Distinct people
33Mentions
0Explicit recommenders
1.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

XZ Utils

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by week33 dated mentions

Observed mentions: 2024-03-17 09:57:00 UTC to 2024-05-19 08:03:34 UTC. Weeks start Monday, UTC.

051015202024-03-11 00:00:00 UTC to 2024-03-18 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsMar 112024-03-18 00:00:00 UTC to 2024-03-25 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-03-25 00:00:00 UTC to 2024-04-01 00:00:00 UTC (exclusive): 20 mentions; 2 submissions, 18 comments2024-04-01 00:00:00 UTC to 2024-04-08 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-04-08 00:00:00 UTC to 2024-04-15 00:00:00 UTC (exclusive): 10 mentions; 3 submissions, 7 commentsApr 82024-04-15 00:00:00 UTC to 2024-04-22 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-04-22 00:00:00 UTC to 2024-04-29 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-04-29 00:00:00 UTC to 2024-05-06 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-05-06 00:00:00 UTC to 2024-05-13 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-05-13 00:00:00 UTC to 2024-05-20 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 commentsMay 13

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Mar 112024-03-11 00:00:00 UTC2024-03-18 00:00:00 UTC101
Mar 182024-03-18 00:00:00 UTC2024-03-25 00:00:00 UTC000
Mar 252024-03-25 00:00:00 UTC2024-04-01 00:00:00 UTC20218
Apr 12024-04-01 00:00:00 UTC2024-04-08 00:00:00 UTC000
Apr 82024-04-08 00:00:00 UTC2024-04-15 00:00:00 UTC1037
Apr 152024-04-15 00:00:00 UTC2024-04-22 00:00:00 UTC000
Apr 222024-04-22 00:00:00 UTC2024-04-29 00:00:00 UTC000
Apr 292024-04-29 00:00:00 UTC2024-05-06 00:00:00 UTC000
May 62024-05-06 00:00:00 UTC2024-05-13 00:00:00 UTC000
May 132024-05-13 00:00:00 UTC2024-05-20 00:00:00 UTC211

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
XZ Utils ======== 0. Overview 1. Documentation 1.1. Overall documentation 1.2. Documentation for command-line tools 1.3. Documentation for liblzma 2. Version numbering 3. Reporting bugs 4. Translations 4.1. Testing translations 5. Other implementations of the .xz format 6. Contact information 0. Overview ----------- XZ Utils provide a general-purpose data-compression library plus command-line tools. The native file format is the .xz format, but also the legacy .lzma format is supported. The .xz format supports multiple compression algorithms, which are called "filters" in the context of XZ Utils. The primary filter is currently LZMA2. With typical files, XZ Utils create about 30 % smaller files than gzip. To ease adapting support for the .xz format into existing applications and scripts, the API of liblzma is somewhat similar to the API of the popular zlib library. For the same reason, the command-line tool xz has a command-line syntax similar to that of gzip. When aiming for the highest compression ratio, the LZMA2 encoder uses a lot of CPU time and may use, depending on the settings, even hundreds of megabytes of RAM. However, in fast modes, the LZMA2 encoder competes with bzip2 in compression speed, RAM usage, and compression ratio. LZMA2 is reasonably fast to decompress. It is a little slower than gzip, but a lot faster than bzip2. Being fast to decompress means that the .xz format is especially nice when the same file will be decompressed very many times (usually on different computers), which is the case e.g. when distributing software packages. In such situations, it's not too bad if the compression takes some time, since that needs to be done only once to benefit many people. With some file types, combining (or "chaining") LZMA2 with an additional filter can improve the compression ratio. A filter chain may contain up to four filters, although usually only one or two are used. For example, putting a BCJ (Branch/Call/Jump) filter before LZMA2 in the filter chain can improve compression ratio of executable files. Since the .xz format allows adding new filter IDs, it is possible that some day there will be a filter that is, for example, much faster to compress than LZMA2 (but probably with worse compression ratio). Similarly, it is possible that some day there is a filter that will compress better than LZMA2. XZ Utils supports multithreaded compression. XZ Utils doesn't support multithreaded decompression yet. It has been planned though and taken into account when designing the .xz file format. In the future, files that were created in threaded mode can be decompressed in threaded mode too. 1. Documentation ---------------- 1.1. Overall documentation README This file INSTALL.generic Generic install instructions for those not familiar with packages using GNU Autotools INSTALL Installation instructions specific to XZ Utils PACKAGERS Information to packagers of XZ Utils COPYING XZ Utils copyright and license information COPYING.0BSD BSD Zero Clause License COPYING.GPLv2 GNU General Public License version 2 COPYING.GPLv3 GNU General Public License version 3 COPYING.LGPLv2.1 GNU Lesser General Public License version 2.1 AUTHORS The main authors of XZ Utils THANKS Incomplete list of people who have helped making this software NEWS User-visible changes between XZ Utils releases ChangeLog Detailed list of changes (commit log) TODO Known bugs and some sort of to-do list Note that only some of the above files are included in binary packages. 1.2. Documentation for command-line tools The command-line tools are documented as man pages. In source code releases (and possibly also in some binary packages), the man pages are also provided in plain text (ASCII only) format in the directory "doc/man" to make the man pages more accessible to those whose operating system doesn't provide an easy way to view man pages. 1.3. Documentation for liblzma The liblzma API headers include short docs about each function and data type as Doxygen tags. These docs should be quite OK as a quick reference. There are a few example/tutorial programs that should help in getting started with liblzma. In the source package the examples are in "doc/examples" and in binary packages they may be under "examples" in the same directory as this README. Since the liblzma API has similarities to the zlib API, some people may find it useful to read the zlib docs and tutorial too: https://zlib.net/manual.html https://zlib.net/zlib_how.html 2. Version numbering -------------------- The version number format of XZ Utils is X.Y.ZS: - X is the major version. When this is incremented, the library API and ABI break. - Y is the minor version. It is incremented when new features are added without breaking the existing API or ABI. An even Y indicates a stable release and an odd Y indicates unstable (alpha or beta version). - Z is the revision. This has a different meaning for stable and unstable releases: * Stable: Z is incremented when bugs get fixed without adding any new features. This is intended to be convenient for downstream distributors that want bug fixes but don't want any new features to minimize the risk of introducing new bugs. * Unstable: Z is just a counter. API or ABI of features added in earlier unstable releases hav
Read the full README on GitHub

What Hacker News says

33 sources
Risking stating the obvious, the linked issue[1] seems appropriate for stack overflow, but not a good fit for github. It would have been a good github issue if there were no instructions in the project. If the instructions are too difficult, then write how you would improve them. If steps are missing or incorrect, report that. Otherwise post to stack overflow. Both: closing the github issue or treating it as an incomplete bug report seems fine to me. The maintainers are doing the latter, I’d say this is a good response. [1]: https://github.com/tukaani-project/xz/issues/121
In Ask HN: Why are people so mean in the open source community? (about xz again)
fazgha·May 19, 2024Submission

Ask HN: Why are people so mean in the open source community? (about xz again)

Browsing the xz repo in GitHub and checking the recent entries in the Issues tab, I just found this entry: https://github.com/tukaani-project/xz/issues/121 The person wasn't able to compile the project and he starts by being mean when he asks for help: - "it shouldn't be this hard" - "the INSTALL file being a TLDR nightmare" - complaining about the compilation steps. I know Larhzu went through a lot in the past but facing again those comments are too much. I appreciate his polite comment to the issue but I would appreciate if he can put people like that in their place like thesamesam did.
15 points · Open discussion
> The payload of the 'hack' contains fairly easy ways for the xz hackers to update the payload. They actually used it to remove a real issue where their hackery causes issues with valgrind that might lead to discovering it, and they also used it to release 5.6.1 which rewrites significant chunks; The valgrind fix in 5.6.1 overwrites the same test files used in 5.6.0 instead of using the injection code's extension hooks. This is done with what should have been a highly suspicious commit: https://github.com/tukaani-project/xz/commit/6e636819e8f0703... - this replaces "random" test files with other "random" test files. The state reson is questionable to begin with but not including the seed used when the the purpoted reason was to be able to re-create the files in the future is highly suspicous. This should have raised red flags bug no one w
Read the rest
as watching. I'd say this is another part of the operation that was much more sloppy than it needed to be. > almost entirely eliminates the value of all those 2 years of hard work. Except control over xz-utils/liblzma would have still been very valuable even without the sshd exploit path as it's central use in the toolchain used to build Linux distributions would have allowed for many other attacks.
In The xz sshd backdoor rabbithole goes quite a bit deeper
This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92... While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it's good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines. - On machines that see lots bots poking at the SSH port, the backdoor noticeably increased CPU load, resulting in degraded user experience and thus overwhelmingly negative user feedback. - The maintainer who added the backdoor has disappeared. - Backdoors are bad for security.
In The xz-utils backdoor has been removed
Hello everybody. I am taking the initiative to gather more information regarding the possible precursors and perpetrators of the backdoor. The purpose of this commentary is focused on open source information (OSINT). I am not a judge of anyone or any action that may occur, the objective of this comment is to help through accurate and quick information to help the core developers of the affected packages and consequently the Linux kernel (which may have been indirectly or directly affected) take action necessary in relation to the fact that occurred. NOTE: This comment will always have "edit" so always review it for information. Information I have so far. Summary: 1. GitHub Account Suspension: - The accounts of @JiaT75 and @Larhzu were suspended by GitHub. - All Tukaani repositories, including downloads, were disabled. - Investiga
Read the rest
te the cause of the account suspensions and whether there is any correlation with suspicious activities. 2. Possible Backdoor in xz/liblzma: - There are concerns about the presence of a backdoor in xz/liblzma. - Investigate whether there is evidence of compromise in the source code and recent updates. - Examine potential impacts, especially if the software is used in critical systems. 3. Updates and Patches in Packages: - Note recent updates in packages such as MinGW w64, pacman-static, Alpine, and OpenSUSE. - Review changelogs to understand if these updates are related to security fixes. 4. Jia's Activities on Platforms and Projects: - Investigate Jia's contributions to different projects and platforms, such as Arch Linux, Alpine Linux, and OpenSUSE. - Check for correlations between Jia's activities and reported security issues. 5. Libera Registration Information: - Analyze Jia's registration details on Libera to determine the timeline of their online activities. - Consider correlating this information with other online activities of Jia. 6. VPN Usage: - Confirm Jia's use of VPN and assess its impact on security investigations. - Explore possible reasons for using a VPN and how it may affect the identification and tracking of online activities. Links related to user JiaT75 [xz] Remove JiaT75 as a contact, determine correct contacts #11760 - Google/oss-fuzz https://github.com/google/oss-fuzz/issues/11760 Tuktest index hash #7 - tukaani-project/xz/pull/7 https://web.archive.org/web/20240329230522/https://github.co...
In Backdoor in upstream xz/liblzma leading to SSH server compromise

Showing the 15 most recent of 33 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.