News for hackers. Stuff that matters.

A comment on Malware Found in the Ubuntu Snap Store. Parent comment

Re:Malware Found in the Ubuntu Snap Store by yrro on Saturday May 12, 2018 @03:12PM (#17055529)
Every line of code should have been reviewed by at least one DD. But the system is self policing, so it's hard to guarantee that that's the case. But Debian certainly leans towards being a curated collection of software rather than a wild west.
[ Parent | on HN ]
Re:Malware Found in the Ubuntu Snap Store by icebraining on Saturday May 12, 2018 @03:15PM (#17055543)
Self-policing? Aren't only DDs allowed to upload to the repositories? From what I understand, dak (the Debian archive management software) won't publish a package which hasn't been approved by a sponsor DD.
[ Parent | on HN ]
Re:Malware Found in the Ubuntu Snap Store by geofft on Saturday May 12, 2018 @03:52PM (#17055698)
The part that's self-policing is that nobody verifies that a DD has in fact reviewed the code that they're signing and uploading (and as another reply points out, for large codebases like the Linux kernel, the maintainer almost certainly doesn't and just trusts the upstream signature).
[ Parent | on HN ]