4 ms·
>but if it raises the costs of attacks, and protects more people that it harms, then it is worthwhile. But how does it raise the cost of attacks? I don't see w
by Arnavion 5y ago
>but if it raises the costs of attacks, and protects more people that it harms, then it is worthwhile.
But how does it raise the cost of attacks? I don't see why it would be harder for someone uploading a malicious package to embed said malicious code in the index.js instead of in the install scripts.
- unilynx 5y agoIf I was installing the module only for use in frontend, eg to be bundled by webpack, the code in your index.js won't execute on the machine but inside the browser sandbox. That makes it a lot harder to steal ssh keys.
- Arnavion 5y agoYes, that's valid, though it isn't about increasing the cost of attacking (what my comment was about).