[Posted July 18, 2026 by corbet]

Adrian Mastronardi has released a book called Half a Second; it is a detailed look into the XZ backdoor attempt of 2024. The book is freely available under a (non-free) noncommercial, no-derivatives CC license.
Half a Second tells that story as one continuous narrative: the burned-out volunteer who maintained the code alone and was patiently, expertly manipulated into giving it up; the engineer whose half-second of curiosity caught the attack through a chain of luck and hard-won instinct; and the operator who built it, who has never been identified and, this book argues, may never be.

to post comments

Physical book?

Posted Jul 18, 2026 18:20 UTC (Sat) by aliceryhl (subscriber, #168048) [Link] (1 responses)

Can I buy it as a physical book?

Physical book?

Posted Jul 19, 2026 12:46 UTC (Sun) by DerekScythe (guest, #185205) [Link]

you can have the pdf for that book

Oh no

Posted Jul 18, 2026 18:23 UTC (Sat) by grawity (subscriber, #80596) [Link] (7 responses)

This too seems to be written in the sort of flowery, "sensationalist" (if that's the right word?) style that some LLMs seem to like generating. I skimmed through the first few chapters and it's almost like someone asked a bot "Make this wordier". Or maybe not, maybe that's legitimately the author's writing style. Either way, it's good that the story is well-referenced, but it soon gets repetitive and more than a bit grating to read.

Oh no

Posted Jul 18, 2026 21:45 UTC (Sat) by linuxrocks123 (subscriber, #34648) [Link]

Some people write like that. I once spent $2.50 in ILL fees to check out "How Not To Network A Nation: The Uneasy History of the Soviet Internet." It turned out to be one of the most awful books I've ever tried to read, primarily because it was written in the style you're describing but also because it wasn't about anything resembling an attempt to create an Internet. I returned it without reading much of it because that way I only wasted my money, not my time.

Oh no

Posted Jul 18, 2026 21:55 UTC (Sat) by richard_weinberger (subscriber, #38938) [Link] (2 responses)

AI polished

Posted Jul 19, 2026 7:45 UTC (Sun) by shemminger (subscriber, #5739) [Link] (1 responses)

AI polished

Posted Jul 19, 2026 11:03 UTC (Sun) by tux3 (subscriber, #101245) [Link]

Oh no

Posted Jul 19, 2026 10:05 UTC (Sun) by jd (guest, #26381) [Link]

Oh no

Posted Jul 19, 2026 10:13 UTC (Sun) by sj (guest, #185124) [Link]

Oh no

Posted Jul 20, 2026 15:39 UTC (Mon) by ethanhawksley (guest, #185218) [Link]

I've been writing a book called "500 Milliseconds" about the xz backdoor for the past month and a bit. I was very surprised when I found out somebody had beat me to it 😅️. It'll be available free on my site or as an ebook, and unlike this one it's entirely human written.

Russ Cox's timeline and attack script analysis

Posted Jul 18, 2026 19:15 UTC (Sat) by jbosboom (guest, #176381) [Link]

For technical readers, Russ Cox's xz attack timeline strikes a good balance between brevity and detail. Russ also walks through the attack shell script in gory detail.

AI Disclosure

Posted Jul 19, 2026 19:33 UTC (Sun) by Jordan_U (subscriber, #93907) [Link]

this is a great read

Posted Jul 20, 2026 17:40 UTC (Mon) by dankamongmen (subscriber, #35141) [Link]