8 ms·
> I could easily serve you a specific malware whereas everyone else and GitHub just sees the benign code. Could you, though? For a GitHub URL?
by dividedbyzero 6y ago
> I could easily serve you a specific malware whereas everyone else and GitHub just sees the benign code.
Could you, though? For a GitHub URL?
- SifJar 6y agoAs far as I can tell, the URLs don't have to be GitHub URLs, you can provide any URL for people to "import"
- dividedbyzero 6y agoThat's true, but I read parent as specifically talking about Github. In general, if it's on a server I control, it's more doable. Still not easy, I guess – how do you tell me apart from everyone else who fetches that same dependency? But it may be doable.
- choeger 6y agoI could obviously not change the content of a GitHub url. Well, at least not for a reasonable cost and effort. But I can easily create a "curl this and execute it" line in a README.md and have it serve malicious code just to you.