3 ms·
Does autotools really matter here? Did folks at the distros really audit the tainted package contents against the source repo and decide that the additional co
by wyldfire 3y ago
Does autotools really matter here? Did folks at the distros really audit the tainted package contents against the source repo and decide that the additional contents must be legitimate?
In all likelihood there's no process to do such an audit? Let's assume such a process did exist, forcing attackers to take a different strategy. Could the rain have hidden in plain sight in the source repo anyways?
- pas 3y agoautotools matter just as much a the obfuscated bash, the tarball, email-only workflows, it's a symptom. we settle for bad tools out of convenience/necessity (status quo bias, time pressure, perverse incentives - ie. it's a hobby project, free and open source, yet half the world depends on it, so half the world prefers it to remain free even if it remains amateurish).