Half a Second – a book about the XZ backdoor

In March 2024, a Microsoft engineer discovered a sophisticated backdoor hidden in XZ Utils, a compression tool used across nearly all Linux systems worldwide, after noticing a half-second delay in login times—a vulnerability that had been deliberately planted over two years by an unidentified attacker. The book examines not only this specific incident but also exposes a broader structural problem: much of the world's critical digital infrastructure depends on small, unglamorous open-source projects maintained by underfunded or unpaid volunteers, leaving them vulnerable to manipulation and exploitation. The narrative follows the burned-out volunteer maintainer who was manipulated into compromising the code, the engineer whose curiosity caught the attack, and the unknown operator responsible.