4 ms·
I would guess the same risk as "npm i" or "pip install": exfiltration of credentials or other supply chain attacks. My greatest threat is not a bitcoin miner bu
by mdaniel 4y ago
I would guess the same risk as "npm i" or "pip install": exfiltration of credentials or other supply chain attacks. My greatest threat is not a bitcoin miner but rather taking advantage of the data on my machine that I'd rather not leave my machine
- acdha 4y agoThis is orthogonal to that point: if I can run code as you, I can exfiltrate your data or write an exploit anywhere writable. The only case where having Homebrew be read-only matters is on a multiuser system where you can do something as a non-admin user.