Yikes. Missed this by 1 day. I updated Handbrake to 1.0.7 on 1st May to compress a bunch of videos. Was a little surprised to see it wasn't signed but after sca

Yikes. Missed this by 1 day. I updated Handbrake to 1.0.7 on 1st May to compress a bunch of videos. Was a little surprised to see it wasn't signed but after scanning it with ClamXav I figured I was safe and installed it on every Mac in the house so I could crank through my project faster. If I understand correctly even if I had in fact downloaded the compromised version ClamXav wouldn't have detected the malware? This kind of stuff is extremely worrying and really strengthens Apple's case for signed application binaries across the board. Are package managers like Homebrew and MacPorts not also susceptible to this kind of binary poisoning?