3 ms·
True, but then how do you know the library was built with the code in the repository? This could introduce a security risk.
by cudgy 4y ago
True, but then how do you know the library was built with the code in the repository? This could introduce a security risk.
- rini17 4y agoAll these build dependencies don't introduce security risk?
- cudgy 4y agoYes, they do. However, accepting pre-built binaries introduces even more risk.
- rini17 4y agoAny basis for your assertion please? Binary infected with malicious payload is more likely to be detected by antivirus or by manual checking of the signature/checksum if user cares to. Infected build system? In case of linux distributions, there are maintainers and packagers responsible for their source and binaries. In case of javascript, does anyone care?