3 ms·
A malicious actor could, however, quite trivially add one to the version number. ;)
by ocdtrekkie 1y ago
A malicious actor could, however, quite trivially add one to the version number. ;)
- arccy 1y agoNo technical solution is going to save you from an upstream going rogue and you blindly updating. The only way is to properly review your dependencies.
- dwattttt 1y agoThe problem isn't an upstream going rogue; it's an upstream going dark, and someone taking advantage of that. Upstreams going dark happens much more often than them going rogue. A system that requires you to prove more than you just control a domain isn't as vulnerable to this problem.