3 ms·

What would you suggest as an alternative to checking in DLLs?

• mdaniel 2y ago
  In general I would expect a mixture of two things: since this is an open source project, it should be building those things from source (even if that source isn't in this specific repo), and/or [related to that one] if it has dependencies upon pre-built binaries then put those in the build script so a reasonable person could audit both what's in that .dll and where it came from. In this specific case it seems like it came from some rando spam site without any idea what is actually in the .dll This situation seems to be on brand for a repo that has a file named malware.c but I am addressing the general case that you asked