Detecting XZ in Debian with Otto Kekäläinen

In this episode, Josh and Otto dive into the world of Debian packaging, exploring the challenges of supply chain security and the importance of transparency in open source projects. They discuss Otto's blog post about the XZ backdoor and how it's a nearly impossible attack to detect. Otto does a great job breaking down an incredibly complex problem into understandable pieces. The show notes and blog post for this episode can be found at https://opensourcesecurity.io/2025/2025-11-xz-debian-otto/

Episode metadata supplied by the publisher feed · Published Nov 2, 2025

Embed this episode

Attribution link and audio player

Ready to play

Detecting XZ in Debian with Otto Kekäläinen

0:00 31:48

1×

No transcript for this episode yet

We transcribe on demand. Request one and we'll notify you when it's ready — usually under 10 minutes.

Share this episode

Similar Episodes

No similar episodes found.

Similar Podcasts

The Red Room Redacted Information Security The show where red team stories from around the world are explored by the guys at Redacted Information Security, and new techniques and tools are pulled apart and discussed. Explicit

Frequently Asked Questions

How long is this episode of Open Source Security?

This episode is 31 minutes long.

When was this Open Source Security episode published?

This episode was published on November 2, 2025.

Can I download this Open Source Security episode?

Yes. Use the download control on the episode player to save the publisher-provided media file.

URL copied to clipboard!