"Half a Second" - a book on the XZ backdoor
摘要
作者 Adrian Mastronardi 撰写，2026 年 7 月更新。书以 2024 年 Microsoft 工程师因半秒登录延迟追查发现 XZ Utils 后门为起点，叙述被耐心操纵的孤独志愿者维护者、未识别的攻击者，以及数字基础设施依赖少量过载志愿者的结构性现实。内容为面向普通读者的解释性叙事非虚构，无需技术背景，网页版提供侧边栏导航和 PDF 下载，采用 CC BY - NC - ND 4.0 许可。
荐读理由
XZ 事件中单个维护者被操纵交出控制权、关键小工具靠疲惫志愿者独自支撑的事实，会改变你对产品开源依赖的供应链风险判断
原文
Half a Second
The Backdoor That Almost Broke the Internet, and the Invisible Labor Beneath It
Author
Adrian Mastronardi
Last updated
July 9, 2026
Welcome
On March 29, 2024, a Microsoft engineer running a routine benchmark at home noticed that logging into a test machine was taking about half a second longer than it should. Almost anyone would have written it off as noise. He chased it instead, and found a backdoor: a hidden, deliberately built way into XZ Utils, a small compression tool that sits unnoticed on nearly every Linux system on Earth, including the servers that carry much of the traffic of the internet. Someone had spent two years putting it there.
Half a Second tells that story as one continuous narrative: the burned-out volunteer who maintained the code alone and was patiently, expertly manipulated into giving it up; the engineer whose half-second of curiosity caught the attack through a chain of luck and hard-won instinct; and the operator who built it, who has never been identified and, this book argues, may never be.
The catch is where the book begins, not what it is about. Underneath the story is a quieter, structural fact. Much of the world’s digital infrastructure is in fact well supported: large companies pay the engineers who write most of the Linux kernel, and the open-source commons draws real and growing investment. But the same economy that funds the big, visible pieces leaves many of the small, unglamorous ones that everything also depends on to a handful of volunteers, often unpaid and overstretched. XZ Utils, maintained for years by a single exhausted person, was exactly that kind of piece, and the incident is the moment that imbalance briefly came into view.
This is interpretive narrative nonfiction, written for the general reader. It assumes no technical background: everything it needs is explained in plain language, in the order the story reaches it.
**
This is the web edition of Half a Second. Use the sidebar to navigate the parts and chapters. You can also download the PDF edition.
License
Copyright © 2026 Adrian Mastronardi
This website is and will always be free, licensed under the CC BY-NC-ND 4.0. If you appreciate reading the book for free and would like to give back, please consider donating to the Open Source Collective, which funds the open-source maintainers this book is about.
这条对你有帮助吗？