3 ms·
tragically, we will get more articles in this genre, as 'security' attracts government funding, and faux security acts are enabled via budgets and megaphones.
by mistrial9 4y ago
tragically, we will get more articles in this genre, as 'security' attracts government funding, and faux security acts are enabled via budgets and megaphones.
- woodruffw 4y agoYep. It bums me out as a contributor to both package indices and someone working on “supply chain” tooling; there’s serious and interesting work to be done here, but it’s general work (universal codesigning, automatic typosquat restrictions in indexes) rather than this kind of lazy blogspam “exploit” whac-a-mole.
- ashishbijlani 4y agoThis. Moreover, such typo-squatting attacks could easily be mitigated by using a private package registry.