3 ms·
> Wow, the way it spreads is fascinating, reminiscent of Reflections on Trusting Trust. Interestingly it's happened to Xcode before, and an impressive number
by FreakLegion 6y ago
> Wow, the way it spreads is fascinating, reminiscent of Reflections on Trusting Trust.
Interestingly it's happened to Xcode before, and an impressive number of bad apps made it to the App Store as a result. See https://en.wikipedia.org/wiki/XcodeGhost https://en.wikipedia.org/wiki/XcodeGhost.
- gridlockd 6y agoThe underrated risk of making your SDK so huge and inaccessible that people would rather get it from untrusted sources.
- panpanna 6y agoIn this case it was partially due to issues with the great Chinese firewall.
- JimDabell 6y agoXcodeGhost wasn’t an attack like this. That was a compromised version of Xcode. This doesn’t require a compromised version of Xcode; it infects Xcode projects. To perhaps put it into more familiar terms, this is as if a malicious Makefile goes around rewriting other Makefiles to include itself.
- FreakLegion 6y agoXcodeGhost was an attack like this in the context of Thompson's lecture, mentioned by Thorrez. Neither fully lives up to Thompson's premise, though. XcodeGhost is the closer of the two.