3 ms·
there's been several attacks recently where a bad actor takes over a repo where the original maintainer wants to take a step back, then launch a supply chain at
by mushufasa 2y ago
there's been several attacks recently where a bad actor takes over a repo where the original maintainer wants to take a step back, then launch a supply chain attack. in recent cases, the attack came from obfuscated binary files in the repo rather than code. given we are dealing with documents here (books) that would be easy to hide malicious code in a file. pdfs have all sorts of execution vulnerabilities for example
- cicko 2y agoPDFs are not executables.
- macintux 2y ago[dead]
- taneq 2y agoYou’d be surprised what’s executable with the right attitude.
- crest 2y agoMay I recommend the old 27C3 talk "OMG WTF PDF"?
- samatman 2y agoOther than the JavaScript, you mean. https://cloudmersive.com/article/Understanding-Embedded-JavaScript-in-PDF-Documents https://cloudmersive.com/article/Understanding-Embedded-Java...
- yoavm 2y agoInteresting - I'm kinda counting on PDF.js, which is used for PDF rendering, on doing it safely, but of course that doesn't always have to be the case. Do you have any thoughts on how to make this safer?
- mushufasa 2y agosome other method of collection where you can hav eknown trust of the files contributed, some method of 'registering' a submission to create trust,