The Design and Implementation of laffer1

github has blocked the xz repository which makes it more difficult for OS projects to track what is going on with the malware. Instead of blocking the repo, they should have put a warning up and blocked downloads of the affected tarballs.