2 ms·

This is pretty funny. He complains that Chromium managed to "bypass this audit-then-build process", by downloading stuff afterwards, while ignoring that this ha

This is pretty funny. He complains that Chromium managed to "bypass this audit-then-build process", by downloading stuff afterwards, while ignoring that this happening already shows that the audit process is completely useless since it failed to recognize and reject the code that would do this. There's a TSA joke somewhere in this.

fweespeech 11y ago
The audit process assumes the upstream maintainers aren't malicious actors attempting to actively bypass the process: > After upgrading chromium to 43, I noticed that when it is running and immediately after the machine is on-line it silently starts downloading "Chrome Hotword Shared Module" extension, which contains a binary without source code. There seems no opt-out config. They don't have the resources to do a full audit on all the packages: https://www.debian.org/security/audit/ https://www.debian.org/security/audit/ > Due to the sheer size of the current Debian release it is infeasible for a small team to be able to audit all the packages, so there is a system of prioritizing packages which are more security sensitive.