> Yes, but it is important to note that these malicious m4 scripts were only present in the tar file. Looks like I got it backwards then. I thought, the test-f

> Yes, but it is important to note that these malicious m4 scripts were only present in the tar file. Looks like I got it backwards then. I thought, the test-files where the sneaky addition. Guess nobody cared for them... > if you maintain a project that needs to support a ton of different platforms, you don't have that much choice in your build tools Yeah, but, if possible, we could start porting those things into better frameworks instead of adding new features to this problematic Linux legacy code base. And maybe we could also retro-fix some of it with a better meta-layer, which generates the problematic code verbosely and standardized. If it can be done for JS a thousand times, it can be done for the *nix ecosystem once. Lastly, part of it is cultural, too. Some people seem to get a kick out of reduced, arcane code, instead of expressive "prose". See, my example above... why the fuck is dot a shortcut for `source`?! Btw. I stumbled into this in Docker documentation[1]: echo \ "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \ https://download.docker.com/linux/debian \ $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \ sudo tee /etc/apt/sources.list.d/docker.list > /dev/null How many people would understand or catch ... $(. /tmp/os-release && echo "$VERSION_CODENAME") | sudo tee ... when `/tmp/os-release` was ... sudo backdoor VERSION_CODENAME=bookworm ... ? Normalizing shit like this is just bad practice. [1] https://docs.docker.com/engine/install/debian/ https://docs.docker.com/engine/install/debian/