4 ms·
If a government gets ssl certs of github then it will possible to MITM and distribute infected deps on millions of projects.
by sanbor 7y ago
If a government gets ssl certs of github then it will possible to MITM and distribute infected deps on millions of projects.
- eitland 7y agoSame as if they pwn debian, redhat, docker, npm, maven (also used by gradle) or Microsoft Windows update infrastructure then? Or am I missing something?
- sanbor 7y agoYes, but instead of having two pwn 5 now they just have to pwn 1.
- eitland 7y agoStill don't get it, if you pwn any of the above it is game over for a 10-30 percent of all computers. Same with GitHub packages, you'll have the possibility to a large number of projects, but far from all IMO.