> ## Content Index
> Fetch the complete content index at: https://tarakiyee.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# What I Learnt from What We Learnt from the xz-utils Incident
- URL: https://tarakiyee.com/what-i-learnt-from-what-we-learnt-from-the-xz-utils-incident/
- Published: 2024-05-23T15:56:15.000Z
- Updated: 2026-08-01T18:08:38.000Z
- Description: Not the xz-utils backdoor, but the month everyone spent talking about it. On the attention economy of a security incident, and what the conversation revealed that the vulnerability didn't.
- Author: Tara Tarakiyee
- Tags: Open Source, Cybersecurity, Supply Chain

I don't know how your April went, but if it was anything like mine, you would have spent an uncharacteristic amount of time talking about compression tools, "insider attacks", and build tooling. That's because on March 29th, 2024, a backdoor was discovered in the widely-used data compression tool xz-utils.

The xz-utils backdoor (known as [CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094?ref=tarakiyee.com) in some circles) exploited OpenSSH's authentication routines in specific operating systems running glibc, and it was hidden within build scripts and test files, making it harder to detect than usual. I'm not talking about the xz-utils incident in this blogpot, I'm talking about how much we talked about xz-utils.

The concept of the attention economy, introduced by Herbert A. Simon in the 1970s, revolves around the idea that human attention is a scarce and valuable resource. In an age where information is abundant but our capacity to consume it is limited, attention has become a commodity. Companies, advertisers, and media outlets all compete to capture and hold our attention because it drives what they need, whether it's engagement, revenue, or influence.

In cybersecurity, this translates to a cycle of intense, short-lived focus on new vulnerabilities, followed by a rapid shift to the next emerging threat. What people do with that attention varies, either they want to sell you a product or an idea, pay their newspaper subscription, or simply to gloat that their flavor of technology is better than whatever the other people are using.

The xz-utils incident is not the first example of the industry's reactive nature, the Heartbleed bug is the quintessential example. Heartbleed captured headlines, sparked endless discussions, and inspired a a plethora of ideas and quick fixes. But once the immediate danger was averted, and [OpenSSL was "saved"](https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/?ref=tarakiyee.com), attention quickly moved on. But many structural issues persisted, and the maintainer burnout to major vulnerability pipeline continues to deliver.

I don't know how we can break the attention economy cycle, all I know is when the next big bad bug happens, we need to resist being reactive and avoid quick fixes, and focus on bringing attention on the structural issues that continue to threaten our software. [I'm proud of STF's response for example.](https://www.sovereigntechfund.de/news/xz-structural-change?ref=tarakiyee.com)

I'm interested to hear if anyone has ideas on how to deal with the attention deficit and moving to a proactive stance. The xz-utils incident was not a wake-up call, if anything it was hitting snooze on your alarm for the 100th time. Rather than allowing the latest crisis to dictate our focus, we need to prioritize long-term, sustainable maintenance of our digital infrastructure, and to get there we need to invest a lot more time, resources, and people into our critical infrastructure.