Linux

While others are saying “no one cares about your personal photos” personal info is not the target of backdoor attacks like this. It’s more likely an attempt to get access to lots of processing power for a crypto mine or botnet.

It’s best practice to have the minimum packages required to run whatever service you are running, don’t add other stuff that you won’t be using. Using a distro that is “outdated” like Debian stable can help since the packages have had more time out in the wild to be tested.

I am sure that the xz incident has raised a lot of alarms across many projects.

As many have pointed out, you don't know that there is not a back door in your software.

One way to defend against such an unknown is to have a method of quickly reinstalling your system, so if you ever suspect you have been compromised you can reload your OS from scratch and reconfigure it with minimal fuss. This is one reason I recommend folks learn one of the configuration management systems like ansible or puppet, and use those to configure your Linux servers. Having config management also helps you recover anfter unexpected hardware failures.

Defense is done in layers. No one layer will protect you 100%. Build up several layers that you trust and understand.

@mfat It's the old problem about bugs. To know that a piece of software has no bugs you should be able to count them and if you could do it then should be able to locate them and make a fix. But you can't then there's no way to know there's no more undetected backdoor

Of course being open source helps a lot but there's no solver bullet

How do you know what you don't know?

That's basically what you're asking. If you have an answer to that general question, it will answer your specific question.