4 ms·
errrm and if a dependency is untrustworthy it can execute code on your system at install time... the fact that no-one else is checking and you are therefore in
by raesene6 11y ago
errrm and if a dependency is untrustworthy it can execute code on your system at install time...
the fact that no-one else is checking and you are therefore in the same boat as other compromised people might not be that much of a consolation
- coldtea 11y agoThe thing is, if thousands use it, then you'd know if it's unsafe... Beyond that, yeah, nothing is absolutely certain in life except death and taxes...
- tamana 11y agoThis assumption fails in the network connected world where a program can download custom instructions after installation.
- coldtea 11y agoIt doesn't fail, it's still as usable as ever -- just not infallible, which nothing is anyway. The dynamics of something with a larger user base being more trustworthy don't change because we're on the internet. It's a simple network (no pun intended) effect. If the program "can download custom instructions after installation" then a large user base still means that users will be bound to find it sooner or later (and make it public/fix it) and it makes it less likely to be you (because you're 1 from 200,000 downloading it, not 1 of 20 or 200).
- raesene6 11y agoin security where breaches can cost a lot of money, relying on heavy use as an indication of trustworthiness may not be a great idea. For example OpenSSL was and is used by lots of people, this has not stopped it having a lot of security problems... And true once the vulnerabilities get published you get to know about the problems more quickly but then in a world of targeted attacks and professional exploitation that might not be great comfort..