News for hackers. Stuff that matters.

A comment on Malicious code in the purescript NPM installer. Parent comment

Re:Malicious code in the purescript NPM installer by ryacko on Sunday July 28, 2019 @10:07PM (#20550974)
Not entirely true, Debian actually made OpenSSL less secure once: https://www.debian.org/security/2008/dsa-1571
[ Parent | on HN ]
Re:Malicious code in the purescript NPM installer by umanwizard on Sunday July 28, 2019 @10:09PM (#20550988)
This doesn’t contradict my point. I never said that Debian maintainers are more trustworthy than upstream 100% of the time.

I merely said that Debian packages are built, uploaded, and vended by Debian package maintainers, not by upstream. Whether that makes them more trustworthy or less is a different question.

[ Parent | on HN ]