3 ms·
What would be the attack vector in this case? Assuming that it's a vulnerability rather than an actually malicious package, how would an attacker exploit someth
by falcor84 6y ago
What would be the attack vector in this case? Assuming that it's a vulnerability rather than an actually malicious package, how would an attacker exploit something running on your CI server? The only way I see is if they already have the ability to modify your source code, at which point it's of course already game over.
- beardedwizard 6y ago"It's already game over", a favorite phrase of many, but a sign you are giving up before the race has even started. Security and insecurity theater at once.
- bdamm 6y agoWhile it's not always considered a risk, there are many cases where being able to run code on a CI server is a vulnerability.
- inbx0 6y agoBut ReDoS does not give them that ability
- deleted 6y ago[deleted]