2 ms·
Absolutely not. GitHub is usually used as a CDN for updates distributed in binary form; it is run by Microsoft. If I download source and build and run it, and
by sneak 2y ago
Absolutely not. GitHub is usually used as a CDN for updates distributed in binary form; it is run by Microsoft.
If I download source and build and run it, and it downloads binaries from Microsoft and runs those, that isn’t remotely “the same people”.
- bmacho 2y agowordpress guy did just that, he had a store/storage/registry for wordpress plugins, and 'forked' someone elses plugin, and started to serve 'his fork' as an update, under the same name and url ( https://news.ycombinator.com/item?id=41888808 https://news.ycombinator.com/item?id=41888808 ) Autoupdate is not good, especially with malicous actors between the user and the developer, which you can't really eliminate. Still it is not literally the same as a trojan.