4 ms·
Several actually. Pypi is regularly targeted in this way.
by LtWorf 6mo ago
Several actually. Pypi is regularly targeted in this way.
- PunchyHamster 6mo agoHasn't happened in Debian
- MomsAVoxell 6mo ago“Hasn’t happened” is quite naive. It happens internally - putting unscrupulous code in a company’s distro before torching the place is a surprisingly regular occurrence in places which have long since adopted Debian as a platform host. IT departments around the globe will benefit from this immensely.
- PunchyHamster 6mo agoAnd reproducible builds do not prevent that. The one single fail point they prevent is infected build hosts. That might be some reasonable benefit for the company if it is building it on public architecture, but for projects like Debian that insist build hosts are basically offline (package in, package out with no internet access during build process) it is very fringe benefit.
- MomsAVoxell 6mo agoNonsense, of course reproducible builds can be used by IT departments to catch nefarious behavior - they regularly do.
- charcircuit 6mo agoBut how many of those attackers also had the ability to publish a github commit but didn't to remain more stealthy.
- LtWorf 6mo agoThis question is meaningless. Attackers will pick the best attack if they have more at their disposal. The fact that they didn't push a commit shows it's better not to. So closing that attack is good.
- charcircuit 6mo agoThere is meaning. The difference in detection time does have meaning. If the improvement of detection time was marginal there may have been a different project time could have been invested in to make it even faster to catch such things than reproducible builds.