3 ms·
Maybe unfair to ask you (but thanks for the helpful answers so far). Is there a check for "this distribution comes from the official source"? Let's say some s
by smallerfish 3y ago
Maybe unfair to ask you (but thanks for the helpful answers so far).
Is there a check for "this distribution comes from the official source"?
Let's say some state actor compromises taaem's desktop computer, and changes the url in the manifest to (say) https://githսb.com/bitwarden/clients/releases/download/desktop-v2023.10.1/Bitwarden-2023.10.1-amd64.deb https://xn--githb-bjg.com/bitwarden/clients/releases/downloa... (that's a unicode lookalike ս in there, which in github at least renders without expansion as "github.com" - HN is smart enough to expand it), or something equally nefarious. CI's not going to catch that, right? And nobody's actually paying attention to changes?
- orra 3y agoNot an expert, but unfortunately I think you're right in identifying a potential attack vector with the Flathub maintainership model. Even if flathubbot is being used, manual changes can still be made by maintainers. And I think there are far more maintainers to trust, than for say scoop or winget. The difference is, Flathub has one repo per package (and hence allows more maintainers).