News for hackers. Stuff that matters.

A comment on Understand filesystem takeover vulnerabilities in NPM JavaScript package manager. Parent comment

Re:Understand filesystem takeover vulnerabilities in NPM Jav... by tomxor on Wednesday January 08, 2020 @09:26PM (#21997978)
Using ~/.local gives you all those things without giving root access, there is no good reason to stick everything in /usr/local especially with something like npm which is wide open for anyone to publish anything instantly.
[ Parent | on HN ]
Re:Understand filesystem takeover vulnerabilities in NPM Jav... by inimino on Friday January 10, 2020 @12:27AM (#22008539)
Yes, and then the question is, should you be putting programs you don't trust at all in your PATH?
[ Parent | on HN ]
Re:Understand filesystem takeover vulnerabilities in NPM Jav... by tomxor on Friday January 10, 2020 @04:52PM (#22015996)
Yes, if i trust them enough to add and not replace binaries.
[ Parent | on HN ]
Re:Understand filesystem takeover vulnerabilities in NPM Jav... by inimino on Sunday January 12, 2020 @10:25PM (#22031579)
But once you run any of those binaries, it's free to replace any of your other (non-root-owned) binaries in `~/.local`. So the trust you're talking about seems to be a preference, but I don't think there's any particularly plausible threat model that makes one of these safer than the other.
[ Parent | on HN ]