29 ms·

lotza binaries with no actual source code, looks more like a supply-chain attack

• g_33_k 6mo ago
  That's a fair concern. The installer is doing a full system setup (nginx, PHP, kiosk, etc.), which is why it's packaged as a release artifact instead of a bunch of inline shell. That said, everything it installs ends up on the Pi in plain files (PHP, JSON, scripts) under /var/www/html/chalkboard, so it's not actually opaque once deployed. I kept the main repo private while building this out, but I get how that looks from the outside — making the runtime files more directly inspectable is something I should probably clean up. Appreciate you calling it out.