2 ms·
> Another way could be for the attacker to breach the origin download server and replace one of the tarballs there with an infected version, and hope that peopl
by EdwardDiego 6y ago
> Another way could be for the attacker to breach the origin download server and replace one of the tarballs there with an infected version, and hope that people skip verifying the signature when they download it
that's a reasonable hope, tbh, I mean, how many FOSS projects recommend installation by curling a script direct into sh?
But he goes on to raise a good point, that someone more security minded will likely notice it sooner rather than later:
> Most people download the latest release, and then it’s enough if a subset checks the signature for the attack to get revealed sooner rather than later.
- kenniskrag 6y agoMay the developer can also monitor the download server and verify the sig with a cron. That will decrease the timeframe for a successful attack. Good idea?
- EdwardDiego 6y agoThat would be a great idea, IMO.
- ekimekim 6y agoAn attacker could mitigate this by having the download server only return the evil version to specific clients, eg. by IP or by user agent.
- SiempreViernes 6y agoSure, but having to add in that code surely causes friction to the whole attack, which is useful.