5 ms·

Most languages, distros, large applications, etc have their own packaging system. Some are more laissez-faire than others. Does someone know a good article fr

Most languages, distros, large applications, etc have their own packaging system. Some are more laissez-faire than others. Does someone know a good article from the POV of the maintainer of a packaging system ecosystem that describes the tradeoffs made by different approaches over the past ~30 years?

hiccuphippo 7y ago
There was a few articles about go's search for a new package system from 2018. Edit: See https://blog.golang.org/versioning-proposal https://blog.golang.org/versioning-proposal and related articles at the bottom.
asdfasgasdgasdg 7y ago
To be clear, as far as I can tell, the ransomware is built using nodejs. It is not a ransomware that's installed via a compromised package. Although if you happen to be a bad guy, it seems like building a quality bitcoin-related package, waiting until you have a big installed base, and then owning all your users, might be an effective way to set yourself up for life.
- carlmr 7y ago
  I thought Bitcoin can't effectively be mined on CPUs anymore, only some AltCoins that are too difficult to compute with ASICs
  - Wowfunhappy 7y ago
    Well, yes, but "effective" is context-dependent. If you have a million computers mining for you, and you're not paying their electricity, it doesn't really matter how individually efficient they are.
  - asdfasgasdgasdg 7y ago
    I'm not talking about a miner. I'm talking about a wallet or some utility module. You'd wait until you have a big installed base then change your module to silently steal coinbase credentials. Wait a few weeks until you have enough of them and then own all the accounts at once. Something like that. The Bitcoin aspect of the module is just to target effectively.
- weare138 7y ago
  >as far as I can tell,the ransomware is built using nodejs Oddly enough, that's what it is. It even drops a full 17MB copy of nodejs to run it and just renames the executable.
  - aussieguy1234 7y ago
    Node processes can also be renamed on the fly, process.name

hiccuphippo 7y ago

There was a few articles about go's search for a new package system from 2018. Edit: See https://blog.golang.org/versioning-proposal https://blog.golang.org/versioning-proposal and related articles at the bottom.

asdfasgasdgasdg 7y ago

To be clear, as far as I can tell, the ransomware is built using nodejs. It is not a ransomware that's installed via a compromised package. Although if you happen to be a bad guy, it seems like building a quality bitcoin-related package, waiting until you have a big installed base, and then owning all your users, might be an effective way to set yourself up for life.

carlmr 7y ago
I thought Bitcoin can't effectively be mined on CPUs anymore, only some AltCoins that are too difficult to compute with ASICs
- Wowfunhappy 7y ago
  Well, yes, but "effective" is context-dependent. If you have a million computers mining for you, and you're not paying their electricity, it doesn't really matter how individually efficient they are.
- asdfasgasdgasdg 7y ago
  I'm not talking about a miner. I'm talking about a wallet or some utility module. You'd wait until you have a big installed base then change your module to silently steal coinbase credentials. Wait a few weeks until you have enough of them and then own all the accounts at once. Something like that. The Bitcoin aspect of the module is just to target effectively.
weare138 7y ago
>as far as I can tell,the ransomware is built using nodejs Oddly enough, that's what it is. It even drops a full 17MB copy of nodejs to run it and just renames the executable.
- aussieguy1234 7y ago
  Node processes can also be renamed on the fly, process.name