Lasse has been active and answering questions on IRC over the last day or so. He says he'll be sharing more information on the XZ site in the days or weeks to come.
He's doing fine, by the way, and mentions that the messages of support are appreciated but not necessary.
He's more focused now on figuring out what happened, how he missed it, and deciding a plan of action for cleaning things up.
(paraphrasing from conversations in the public channels)
It's the mail from Saturday, why would you post it now as if it was new? It was already discussed to death here.
This post it timestamped March 30, which is "just" three days ago; but in this case is _over_ three days ago.
Doesn't give much more information except that he wasn't immediately picked up by LEO.
Poor guy will go through more stress now even more than that created and imposed on him over 2 years by the attacker.
If anything we should encourage him to look back at his mental health as not being his fault and that we need to protect ourselves.
Already discussed 2 days ago
Signs of life from Lasse and a link to his web containing more information: https://tukaani.org/xz-backdoor/
Posting in support of Collin. I'm sorry this happened to you, and thanks for your hard and thankless work!!
Points for Collin for letting his holiday take precedence over this mess.
Don’t forget that he made xz for free, as a hobby project, and likely got duped by “Jia Tan” same as everybody else did. He’s not obligated to solve this on any particular timeline.
Xz is not a business, so if your business got in trouble because a single solo hobby dev was a bit too trustful, it’s your job, and not his, to mitigate the problem.