3 ms·
My software is packaged by Debian, and the update process is me notifying the Debian Developer (DD) responsible for the package of the new version => said DD pu
by oefrha 7y ago
My software is packaged by Debian, and the update process is me notifying the Debian Developer (DD) responsible for the package of the new version => said DD pulling the new tarball from GitHub. Pretty sure no one’s gonna notice until after it’s pushed to Debian FTP if I introduce some subtle malicious code. Point is DDs don’t review version deltas for the most part, so when the upstream is compromised, they add little to your defense (other than security by outdatedness, I suppose).
- umanwizard 7y agoSure, but a very long time will pass between it being uploaded and being merged into stable, so there is a lot of time for people to discover your malicious code. It is not like npm or crates.io where you can just upload whatever random code you like and people will start picking it up immediately. But it’s not foolproof, sure, I agree with that.