3 ms·
Correct, the above mitigation is only for malware on the dev laptops and build servers. IOW, it doesn't prevent injecting the malware on your program when compi
by efortis 3y ago
Correct, the above mitigation is only for malware on the dev laptops and build servers. IOW, it doesn't prevent injecting the malware on your program when compiling it.
- eptcyka 3y agoProd is bad, but stealing signing keys or credentials is worse.
- zoover2020 3y agoShouldn't build servers have limited or zero network connectivity in the first place?
- deleted 3y ago[deleted]
- silverliver 3y agoModern languages make offline builds far more difficult then they have to be, unfortunately. Rust, for example, buries its off-line installer on another domain. Rust also doesn't advertise or encourage bundling dependencies. Lastly, unrestricted build scripts basically give every dependency full code execution.