5 ms·
Serious question: what’s the difference? Do Linux distros actually audit packages very much? Supply chain attacks in Linux distros are pretty scary, as you can
by noodlesUK 4y ago
Serious question: what’s the difference? Do Linux distros actually audit packages very much? Supply chain attacks in Linux distros are pretty scary, as you can basically expect them to run install scripts as root.
- goodpoint 4y ago> Do Linux distros actually audit packages very much? It varies widely depending on the distro. Debian is the the most strict on review process but also on screening the volunteers doing the work. Yet, most popular distros has been very effective at blocking a large number of supply chain attacks over the last 20 years.
- Gigachad 4y agoA bit, but I assume it’s mostly just the extra friction to get things in that acts as the main filter. Malware has made it in to Debian before. See the xscreensaver time bomb. The extra friction also makes Linux package managers useless. Just about 0% of the things people are installing with npm exist in distro repos. Distro repos are also extremely poor at keeping multiple versions around at once. Surprisingly people don’t like having their react upgrade tied to the Debian major version update.