3 ms·
May the developer can also monitor the download server and verify the sig with a cron. That will decrease the timeframe for a successful attack. Good idea?
by kenniskrag 6y ago
May the developer can also monitor the download server and verify the sig with a cron. That will decrease the timeframe for a successful attack. Good idea?
- EdwardDiego 6y agoThat would be a great idea, IMO.
- ekimekim 6y agoAn attacker could mitigate this by having the download server only return the evil version to specific clients, eg. by IP or by user agent.
- SiempreViernes 6y agoSure, but having to add in that code surely causes friction to the whole attack, which is useful.