4 ms·
> Open source software is especially vulnerable ... the hacker can just compile the program from sources and add his own code You must be too young to remember
by woodman 11y ago
> Open source software is especially vulnerable ... the hacker can just compile the program from sources and add his own code
You must be too young to remember how computer viruses originally spread by way of modified executable files: http://computervirus.uw.hu/ch04lev1sec2.html http://computervirus.uw.hu/ch04lev1sec2.html
- justsaysmthng 11y agoActually, dabbling in virus writing was the most exciting thing I could do on my 4.77Mhz 8086 running MSDOS 3.3 back in the day :). Patching is possible, but why bother when you can compile the app from sources? Nice book btw.
- woodman 11y ago> but why bother when you can compile the app from sources? Well, imagine that you are the attacker here. Would you rather keep your malware source in sync with the upstream code and build every target every update, or just use an off the shelf binary wrapper. Would you answer the same if you were targeting more than one app (in the case of a CDN attack)? The only scenario in which source level malware makes sense to me is this: you are targeting a specific application and you are able to get your code into the project's SCM. In this scenario OSS is no more vulnerable than closed source.