--- title: "Half a Second" — a book on the XZ backdoor | daily.dev description: Adrian Mastronardi has released a book titled 'Half a Second' that provides a detailed narrative account of the 2024 XZ Utils backdoor incident. The book... canonical: https://daily.dev/posts/half-a-second-a-book-on-the-xz-backdoor-qpoe1ej8m twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: "Half a Second" — a book on the XZ backdoor | daily.dev og:description: Adrian Mastronardi has released a book titled 'Half a Second' that provides a detailed narrative account of the 2024 XZ Utils backdoor incident. The book... og:url: https://daily.dev/posts/half-a-second-a-book-on-the-xz-backdoor-qpoe1ej8m og:image: https://api.daily.dev/og/posts/QPOe1ej8m.png og:image:alt: "Half a Second" — a book on the XZ backdoor og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # "Half a Second" — a book on the XZ backdoor **[LWN.net](https://daily.dev/sources/lwn)** · 1 min read · 0 upvotes · 2 comments ## Summary Adrian Mastronardi has released a book titled 'Half a Second' that provides a detailed narrative account of the 2024 XZ Utils backdoor incident. The book covers three perspectives: the burned-out open source maintainer who was manipulated into handing over access, the engineer whose brief moment of curiosity uncovered the attack, and the still-unidentified attacker. The book is freely available under a noncommercial, no-derivatives Creative Commons license. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the XZ Utils backdoor attempt and who was involved? The XZ Utils backdoor was a 2024 supply chain attack in which an attacker patiently gained the trust of a burned-out, solo volunteer maintainer to insert malicious code into the widely used compression library. The attack was ultimately caught by an engineer who noticed a half-second delay during routine testing and investigated further, exposing the compromise before it spread widely. The operator behind the attack has never been identified. _Developers tracking software supply chain risks follow ongoing analysis of incidents like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@ethanhawksley** · 1 upvotes > Just finished writing my book [The Second Maintainer: Inside the XZ Utils Backdoor](https://hawksley.dev/the-second-maintainer)! I ended up renaming it from 500 milliseconds to distinguish myself better from this other book. I know some people on lwn have been interested in it, so thought I'd let them know. **@ethanhawksley** · 1 upvotes > I've been writing a book called "500 Milliseconds" about the xz backdoor for the past month and a bit. I was very surprised when I found out somebody had beat me to it 😅️. It'll be available free on my site or as an ebook, and unlike this one it's entirely human written. ## Similar posts on daily.dev - [The people holding up the internet](https://daily.dev/posts/the-people-holding-up-the-internet-nnwoz3nvr) · Lobsters · 8 upvotes · 0 comments - [Could the XZ backdoor have been detected with better Git and Debian packaging practices?](https://daily.dev/posts/could-the-xz-backdoor-have-been-detected-with-better-git-and-debian-packaging-practices--rg1zju4bp) · Hacker News · 1 upvotes · 0 comments - [The XZ Utils aftermath: Inside the mission to stop the next global backdoor before it starts](https://daily.dev/posts/the-xz-utils-aftermath-inside-the-mission-to-stop-the-next-global-backdoor-before-it-starts-enx54itv6) · The New Stack · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#open-source](https://daily.dev/tags/open-source) [View this post on daily.dev](https://daily.dev/posts/half-a-second-a-book-on-the-xz-backdoor-qpoe1ej8m) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"\"Half a Second\" — a book on the XZ backdoor","url":"https://daily.dev/posts/half-a-second-a-book-on-the-xz-backdoor-qpoe1ej8m","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/half-a-second-a-book-on-the-xz-backdoor-qpoe1ej8m"},"datePublished":"2026-07-18T16:54:05.985Z","dateModified":"2026-10-15T02:22:35.638Z","description":"Adrian Mastronardi has released a book titled 'Half a Second' that provides a detailed narrative account of the 2024 XZ Utils backdoor incident. The book...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"LWN.net","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LWN.net","logo":"https://media.daily.dev/image/upload/s--4jjE7GIK--/f_auto,q_auto/v1774960833/logos/lwn?_a=BAMAMiWQ0","url":"https://daily.dev/sources/lwn"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/half-a-second-a-book-on-the-xz-backdoor-qpoe1ej8m","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"cyber,open-source","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LWN.net","item":"https://daily.dev/sources/lwn"},{"@type":"ListItem","position":3,"name":"\"Half a Second\" — a book on the XZ backdoor"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/half-a-second-a-book-on-the-xz-backdoor-qpoe1ej8m","comment":[{"@type":"Comment","text":"Just finished writing my book The Second Maintainer: Inside the XZ Utils Backdoor! I ended up renaming it from 500 milliseconds to distinguish myself better from this other book. I know some people on lwn have been interested in it, so thought I’d let them know.","datePublished":"2026-09-03T13:42:07.623Z","url":"https://daily.dev/posts/QPOe1ej8m#c-IO7QMUIOT","author":{"@type":"Person","name":"Ethan","url":"https://daily.dev/ethanhawksley","image":"https://media.daily.dev/image/upload/s--wmRytQ7p--/f_auto/v1784561626/avatars/avatar_7SkYFnBxwYiBUnO7Ep58h?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"I’ve been writing a book called “500 Milliseconds” about the xz backdoor for the past month and a bit. I was very surprised when I found out somebody had beat me to it 😅️. It’ll be available free on my site or as an ebook, and unlike this one it’s entirely human written.","datePublished":"2026-07-20T15:32:16.697Z","url":"https://daily.dev/posts/QPOe1ej8m#c-9eTDGB9JH","author":{"@type":"Person","name":"Ethan","url":"https://daily.dev/ethanhawksley","image":"https://media.daily.dev/image/upload/s--wmRytQ7p--/f_auto/v1784561626/avatars/avatar_7SkYFnBxwYiBUnO7Ep58h?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/half-a-second-a-book-on-the-xz-backdoor-qpoe1ej8m#faq","mainEntity":[{"@type":"Question","name":"What is the XZ Utils backdoor attempt and who was involved?","acceptedAnswer":{"@type":"Answer","text":"The XZ Utils backdoor was a 2024 supply chain attack in which an attacker patiently gained the trust of a burned-out, solo volunteer maintainer to insert malicious code into the widely used compression library. The attack was ultimately caught by an engineer who noticed a half-second delay during routine testing and investigated further, exposing the compromise before it spread widely. The operator behind the attack has never been identified. Developers tracking software supply chain risks follow ongoing analysis of incidents like this on daily.dev."}}]} ```