3 ms·
That's a very real problem, but one would hope that package managers would be a lot more widely adopted in that counterfactual world. Maybe that's a naive hope.
by livueta 3y ago
That's a very real problem, but one would hope that package managers would be a lot more widely adopted in that counterfactual world. Maybe that's a naive hope.
- yesco 3y agoMost people call them app stores these days
- hnlmorg 3y agoDesktop software runs with fewer protections than web applications. So unless everyone is planning on becoming SELinux experts tomorrow, the web still makes sense for a lot of stuff. Hence why exploits like these are always about getting software installed onto the host rather than being 100% JS. And before anyone says “but package managers solve this problem”, no they don’t. There have been numerous cases of compromised software leaking into office repositories. It happened with a Ubuntu package were an attacker hacked the upstream repository. It’s happened with npm. Browser extensions from Google and Firefox repos are frequently a source for Trojans. Android and iOS have lots of apps that appear to be free torches or other such utilities but are actually just harvesting all your data. Just because a software package is published to an official repository, it doesn’t make that package safe.