4 ms·
> I'm simply pointing out that if we assume that the distribution channel is compromised, any distribution channel could help distribute malicious software, no
by choeger 5y ago
> I'm simply pointing out that if we assume that the distribution channel is compromised, any distribution channel could help distribute malicious software, not just if you use "curl | bash" method.
And from that you conclude that all channels must be equal? That's a logical fallacy. There are trusted channels like the debian repos. Or maybe cargo, pypi, etc. And then there is this abomination.
This is like comparing a vaccination at your doctor's office to a needle found in the park (the needle looks respectable, of course) and stating "well, theoretically, my doctor could inject me poison as well, so it's probably ok to take this one here".
- Godel_unicode 5y agoI love me some pypi, but it's hardly a trusted channel. There's no approval process for uploading, and there's very limited code inspection (until last fall there was none). There have been repeated examples of typo squatting malware which has been resident on pypi, which is why there are tons of security products designed specifically to allow you to use pypi safely. https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/ https://www.zdnet.com/article/two-malicious-python-libraries...
- capableweb 5y ago> And from that you conclude that all channels must be equal? That's a logical fallacy. There are trusted channels like the debian repos. Or maybe cargo, pypi, etc. And then there is this abomination. Are you asking me or telling me? As the rest of your message assumed that I already answered the question. As to my answer: No.