0:00.00 / 1:29.00

Chapters

Five hundred milliseconds

A failed SSH login took half a second too long. That half second exposed the xz-utils backdoor (CVE-2024-3094), which shipped only in release tarballs.

Remotion 4: React and SVG, rendered frame by frame to H.264
Each frame a pure function of useCurrentFrame(); shot times in one cues.json
Reusable timeline, tarball scan, dependency chain, latency meter and kinetic type
Seeded, synthesised soundtrack cued from the same file
Render from remotion/: npm run render (makes the audio, then npx remotion render FiveHundredMs)

Sources: Freund's disclosure, CVE record, Russ Cox's timeline.

Back to gallery