News for hackers. Stuff that matters.

A comment on A backdoor in the Ruby gem bootstrap-sass.

Re:A backdoor in the Ruby gem bootstrap-sass by vemv on Saturday April 13, 2019 @09:01AM (#19652769)
A few more of these and we'll all ditch package managers in favor of plain git repos. Commit SHAs inherently guarantee content integrity.
[ Parent | on HN ]
Re:A backdoor in the Ruby gem bootstrap-sass by daxelrod on Sunday April 14, 2019 @12:43PM (#19660367)
Can you elaborate on how you see this as an integrity problem? A new malicious version was released; at no point did the attackers represent their new release as the same code as the previous release.
[ Parent | on HN ]
Re:A backdoor in the Ruby gem bootstrap-sass by vemv on Wednesday April 17, 2019 @11:17AM (#19683310)
When you "git all the things", upgrading a dependency can equal a `git diff`. Upgrades become reviewable.

I envision a future where organisations routinely review upgrades.

[ Parent | on HN ]