Re:Questions to ask a company during a job interview
by nemetroid on Tuesday September 10, 2019 @12:27PM
(#20929964)
> Ah yes - gotta love the HN pedantry - you are of course technically correct, however - a library used by Notepad++ was compromised for a period of time.
No, it wasn't either. The security "issue" was that a shared library loaded by Notepad++ could be replaced with a compromised one. At no point did either Notepad++ or the library authors distribute a compromised version of that library.
Being able to replace shared libraries is not a security issue, it's the number one (or number two, depending on who you ask) reason for having shared libraries in the first place. It's like saying that if I compiled a custom version of glibc and installed it on a computer, the entirety of the GNU ecosystem was compromised.
No, it wasn't either. The security "issue" was that a shared library loaded by Notepad++ could be replaced with a compromised one. At no point did either Notepad++ or the library authors distribute a compromised version of that library.
Being able to replace shared libraries is not a security issue, it's the number one (or number two, depending on who you ask) reason for having shared libraries in the first place. It's like saying that if I compiled a custom version of glibc and installed it on a computer, the entirety of the GNU ecosystem was compromised.