5 ms·
Aptly timed vulnerability with this article https://research.swtch.com/deps https://research.swtch.com/deps
by erickj 8y ago
Aptly timed vulnerability with this article https://research.swtch.com/deps https://research.swtch.com/deps
- anfilt 8y agoI do find just pulling dependencies blindly from the internet concerning.
- y0ghur7_xxx 8y agoWhat is the alternative? What do you propose?
- jerf 8y agoNot blindly pulling in dependencies from the internet? "Blindly" is the problem here, not "pulling dependencies" or "internet". Also, no, you won't get to a literally 0.0000...% chance of bad stuff getting in to your code, but some simple due diligence will slice several factors of magnitude off your probabilities; pick up another couple of factors if the community in general also tends to have people examining their dependencies. It gets to be pretty hard to sneak stuff in under those circumstances. It's been done, so we know it's not 0.0000...% likely, but it's less likely than the current state of the art in several language communities. (And, also, yes, said language communities are working on it. I salute them for this effort, not condemn them for the existing problem.)
- acdha 8y agoHillel Wayne did a detailed in-depth analysis of the event-stream issue and it's really worth reading if you're interested in how to change this situation to be more robust: https://www.hillelwayne.com/post/stamping-on-eventstream/ https://www.hillelwayne.com/post/stamping-on-eventstream/
- SmellyGeekBoy 8y agoPGP?
- rch 8y agoI probably still have some old Slackware discs around somewhere.
- anfilt 8y agoAlso the discussion on it here: https://news.ycombinator.com/item?id=18979596 https://news.ycombinator.com/item?id=18979596
- zozbot123 8y ago> Aptly timed vulnerability I C what you did there https://www.debian.org/security/2019/dsa-4371 https://www.debian.org/security/2019/dsa-4371
- dullgiulio 8y agoAlmost, you are mixing up homepage posts. You are talking about https://news.ycombinator.com/item?id=18958679 https://news.ycombinator.com/item?id=18958679.
- erickj 8y agoI wish I was that clever