XZ Attack Decomposed

David Westbrook and I wrote a high-level overview of the XZ attack for a general audience in The XZ Attack and Digital Infrastructure Insecurity. Well worth a read if you want a holistic analysis of a sophisticated attack that addresses both social and technical issues.