‘Half a Second’ chronicles the XZ Utils backdoor attempt—from a patient impostor maintainer to the half-second latency that exposed the plot.
Update July/20/2026 6:10 PM EDT: Oops! We can evidently add this to the things we wished we’d known before we went to press. It appears that this book was likely written by AI. I’m posting this update because, as the colleague who alerted me to this put it, “It’s free, but people’s time is not.” The good news is that this will go up before too many people find this article.
The real news story here is that AI is automating yet another skill previously limited to humans. The book was probably written using software the “writer” of the book created. The software is called “bookwright” and can be found on the AdrianMastronardi/bookwright page on GitHub. According to the description, the software provides “a structured pipeline for writing long-form nonfiction, packaged as a Claude Code skill.” It’s released under the “permissive” MIT license.
Jonathan Corbet, who originally posted about the book on LWN.net, also chimed in on a mailing list discussion: “I got surprised by that one too. One has to look askance at everything anymore. In this case, at least, it seems that there was quite a bit of real research done before the model took over.”
True dat. There was that bit of a silver lining.
Published 3:00 PM EDT: Do you remember the XZ backdoor that was a huge news story in the tech world in 2024? I’d all but forgotten it myself, until a brief item from Jonathan Corbet on LWN.net caught my eye on Saturday. It seems that the complete story of the exploit has been turned into a book that’s available for free.
The story made a fair amount of news at the time. The exploit had the potential to easily infect nearly every installation of Linux running on the planet — whether serving websites from a data center or running consumer PCs in private homes — and could be used to hijack the OpenSSH server on affected systems by bypassing authentication for remote access. Pretty serious stuff, eh?
The steps taken to install the backdoor and spread the exploit was like something from a classic movie plot — “The Sting”… or better yet, “The Maltese Falcon.” To paraphrase Bogart’s Sam Spade from the latter, it was the stuff that nightmares are made of. It’s the story of a long con, that began with a developer using the handle Jia Tan spending several years to gain trust and eventually maintainer status at an underfunded software project that developed a small but critical component of the Linux system.
The project was XZ Utils, an open‑source compression tool that many if not most Linux distributions use for packaging and file compression. It sits low in the stack, so compromising it can indirectly affect a large number of systems running above it. The backdoor that Jia Tan introduced made it possible to hijack the OpenSSH server on affected systems, and potentially bypass authentication for remote access.
To this day, the identity of black hat developer remains unknown, which means the perpetrator is still at large. The good news is there were no confirmed reports of widespread exploitation, but the incident is now seen as one of the most serious open‑source supply‑chain near‑misses since Log4j, and it sparked renewed debate about funding and securing critical volunteer‑maintained projects.
“Half a Second” is the title of Adrian Mastronardi’s recently released book that chronicles the event. The title is taken from a half-second delay that Microsoft engineer and PostgreSQL developer Andres Freund noticed when logging onto a test machine when running some routine benchmarks at home. His investigation into that delay led directly to his discovery of the backdoor.
“Much of the world’s digital infrastructure is in fact well supported: large companies pay the engineers who write most of the Linux kernel, and the open-source commons draws real and growing investment,” Mastronardi writes in the book’s online introduction. “But the same economy that funds the big, visible pieces leaves many of the small, unglamorous ones that everything also depends on to a handful of volunteers, often unpaid and overstretched. XZ Utils, maintained for years by a single exhausted person, was exactly that kind of piece, and the incident is the moment that imbalance briefly came into view.”
I haven’t read the book yet, but it’s definitely at the top of my list. From a quick look, it appears to tell the story in great detail, covering every aspect that would be of interest to open source aficionados in 16 chapters spread across four main sections: The Discovery, The Long Setup, The Foundation, and The Aftermath. It’s available to read online, with free downloads also available in PDF and EPUB formats. Mastronardi has released the book under the CC BY-NC-ND 4.0 license.
“If you appreciate reading the book for free and would like to give back, please consider donating to the Open Source Collective, which funds the open-source maintainers this book is about,” Mastronardi says on the book’s website.
Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux
Be First to Comment