5 ms·
The point everyone seems to be missing, and the one I think most important, is that we're no longer building from trusted sources. Build systems just download
by badloginagain 8y ago
The point everyone seems to be missing, and the one I think most important, is that we're no longer building from trusted sources.
Build systems just download and run random code from the internet without verifying that its the correct code, from the correct source.
Its a ticking time bomb.
- dullgiulio 8y agoThere is SSL/TLS, unless it's done wrong (invalid certificates get ignored by the dependencies manager), it's safer than the old "md5 of the file" systems. Now, some dependencies are fraudolent (especially true in the Javascript world because it eventually targets a lot of user browsers), but nobody ever checked the sources anyway...
- cesarb 8y agoTLS only verifies that have connected to the correct server. It can't verify whether the package on the server has been replaced by a malicious one. For that, you need a "md5 of the file" (these days, a sha256, because md5 has long been broken).
- dullgiulio 8y agoYou need to make sure the hash is also not tampered, both on server and in flight to the user. How do you do that? If the answer is: use TLS, there is no point in having the file hash at all.
- dijit 8y agoNo, the answer is to use PGP and a manifest hash. This is how package managers work. TLS doesn't replace those.