5 ms·
Security is hard. In this case, it seems like there's a lot that could be done to reduce the chance of being exploited. Why are obscure binaries in the reposi
by cassianoleal 3y ago
Security is hard.
In this case, it seems like there's a lot that could be done to reduce the chance of being exploited.
Why are obscure binaries in the repository at all in the first place, even if in the test dir? Surely those binaries can be generated as a setup step prior to the tests actually running.
Furthermore, why are there scripts present in the release package that have not been added to the source code?
Also, if I understood it correctly, the compromised binaries are also present in the release tarball. Why are they part of the release if they are supposedly test fixtures rather than part of the application code?
- cesarb 3y ago> Why are they part of the release if they are supposedly test fixtures rather than part of the application code? Test fixtures should be distributed together with the application code, so that the actually built application can be tested. Ideally, the application should be tested every time it's built, to ensure that for instance a change in the compiler being used didn't break it.
- cassianoleal 3y agoThanks, that makes sense. I think in my mind the whole chain was still source code->compile->test->distribute from a single repo which is obviously not the case. It’s more like source->package->test->ship to distros->compile->test->package->distribute