4 ms·
What keeps Linux distributions safer is that fewer people are able to push updates and there’s a time delay. The compromises are because people exploit release
by acdha 2mo ago
What keeps Linux distributions safer is that fewer people are able to push updates and there’s a time delay. The compromises are because people exploit release pipelines and if your build infrastructure is compromised it’ll merrily sign the compromised packages as well.
- lrvick 2mo agoWhich is why automated signatures in release pipelines are usually meaningless. Authors must sign their code on their own hardware before it is published so we can tell when the signing key changes and pay extra special attention to that, and maybe a longer delay.