The Internet Was Weeks Away From Disaster And No One Knew
Why Hacker News recommends it
Cited as an accessible, documentary-style account of the XZ backdoor in supply chain security discussions.
What it is
Veritasium tells the story of the XZ backdoor, how a patient attacker became maintainer and nearly compromised SSH on Linux systems. It also covers free software history and how encryption in SSH works.
Recommended by 1 HN commenters across 1 different months, 2026 to 2026.
What Hacker News said
Recommends ajoy · 2026-03 · on “Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised”
Reminded me of a similar story at openSSH, wonderfully documented in a "Veritasium" episode , which was just fascinating to watch/listen. [this video]
Cites nerevarthelame · 2026-02 · on “Story of XZ Backdoor [video]”
Still no smoking gun, but possibly Russia. From the video [this video] : > A lot of the aliases, like Jia Tan, they sound like Asian names, and the published changes are all timestamped in UTC+8, Beijing time. So the signs point to China. And that's why it's probably not China. I mean, why would they make it that obvious? Every other part of the operation has been so meticulous, so cautious. > And they also worked on Chinese New Year, but not on Christmas. And over the years, there were nine changes that fall outside of the Beijing time into UTC+2, which is a time zone that includes Israel and parts of Western Russia. That's why some experts have speculated that this could be the work of APT29, a
Cites briansm · 2026-03 · on “The Xkcd thing, now interactive”
Just to mention the original was cited in the most recent Veritasium video: "The Internet Was Weeks Away From Disaster and No One Knew" [this video] (at about the 9:50 mark)
Cites rolandog · 2026-04 · on “Nvim-treesitter (13K+ Stars) is Archived”
Agreed. However, I often wonder if people like that are deliberately (or inadvertently) being a psyop seeking to burn out people ala how "Jia Tan" tried to become maintainer of xz [0]. [0] [this video]