3 ms·
I'm curious about big commits like this one: In the context of the recent juniper attack where some unauthorized code was committed without anybody noticing fo
by gouggoug 11y ago
I'm curious about big commits like this one:
In the context of the recent juniper attack where some unauthorized code was committed without anybody noticing for years, it seems like it would be easy to hide a backdoor in such a big commit.
How do you go about checking the integrity of the code when you have so many files?
8902 files were changed, most added, and the commit says it's just importing openJDK files. Is there anybody checking that the source file imported haven't been modified to include some kind of backdoor?
edit: replaced "cisco" with "juniper"
- signa11 11y ago> ...recent cisco... you mean juniper perhaps?
- gouggoug 11y agoWoops... it's fixed!
- lunixbochs 11y agoI like this thinking. Someone with a big export of code repos could do some automated diff/analysis on open-source code to find vendored imports that have been modified from upstream or is outdated to facilitate manual security audits.
- ZoFreX 11y agoThe same way I validate scary merge commits: Do it myself, and compare what I get to what they got.