3 ms·
Adding MITM to your chain of trust doesn't make it more trustworthy, it adds an extra possible attacker.
by SAI_Peregrinus 2y ago
Adding MITM to your chain of trust doesn't make it more trustworthy, it adds an extra possible attacker.
- m4rtink 2y agoOften there is vetting before one becomes a distro maintainer & even if one of them gets compromised, the blast radius is at least limitted to that one distro, rather than "everyone" like in case of NPM & co. Non rolling distros aslo have various policies for package updates, making it much harder to get a compromised package to all supported distro versions before it is eventually discovered.
- imoreno 2y agoActually it does. The repo maintainer is on the user's side, so they are doing MITM on the attack vector. This makes it harder to get your malicious code in, because MITM might intercept it. Yes now you have to trust the maintainer but that's sometimes easier.