4 ms·
First I think that it is wrong to single out this issue on Open Source projects. For example, since the first versions of app stores, when you are an app devel
by greatgib 2y ago
First I think that it is wrong to single out this issue on Open Source projects.
For example, since the first versions of app stores, when you are an app developer you would receive a lot of messages from random shady dudes ready to buy your application if it had a few users.
Also, the xz thing was kind of pretty smart, but it is also a thing in mind of most OSs developers that you can't trust any random contributor and so that you will be very careful of really knowing someone before giving some privilege.
Just look how the debian policies were designed or that things like "pull requests" were invented for Open Source projects where everyone in a project used to be allowed to push whatever in private ones before.
- lazyasciiart 2y agoChrome extensions have also been subject to those purchase offers for a long time.
- williamdclt 2y agoThe scope of impact if a mobile app becomes malicious is _immensely_ smaller than if xz becomes malicious. The latter seems to be national security level
- kibwen 2y agoOnly because most people aren't using mobile apps for real work. But if someone were using a mobile app to perform SSH and the app is backdoored, it's game over for any server you SSH into.