3 ms·
> The libarchive vulnerabilities could allow a malicious third-party to distribute update archives that could place arbitrary files on the filesystem. Why do
by rodgerd 10y ago
> The libarchive vulnerabilities could allow a malicious third-party to distribute update archives that could place arbitrary files on the filesystem.
Why do people keep doing this crap every time they re-invent the packaging wheel? And it's particularly awful from something purporting to be more secure than vanilla FreeBSD (which generally purports to be "better engineered" than Linux, where sane behaviour for distributing binaries is a long-solved problem).
- Jasper_ 10y ago> (which generally purports to be "better engineered" than Linux, where sane behaviour for distributing binaries is a long-solved problem). Assuming your "sane behavior" is referencing .deb and .rpm files, both of those let you run arbitrary, attacker-provided shell scripts as root whenever you install, upgrade, or even uninstall a package.
- rodgerd 10y agoBut have mechanisms to assure they aren't tampered with in-flight.
- deleted 10y ago[deleted]