News for hackers. Stuff that matters.

A comment on Supply-chain attack hits RubyGems repository with malicious packages. Parent comment

Re:Supply-chain attack hits RubyGems repository with malicio... by akira2501 on Saturday April 18, 2020 @01:40PM (#22909451)
That's part of the reason I feel uncomfortable with "modern" package systems like golang's. I really want to use golang more, but I just don't feel 'secure' about building a bunch of packages pulled off of github by URL.
[ Parent | on HN ]
Re:Supply-chain attack hits RubyGems repository with malicio... by _eht on Saturday April 18, 2020 @02:38PM (#22910019)
Third-party package management is not a modern marvel by any means. You are unnecessarily singling out golang, and if you let that stop you from learning it's your loss. Just be smart. Dependency awareness is not black magic.
[ Parent | on HN ]
Re:Supply-chain attack hits RubyGems repository with malicio... by jatone on Saturday April 18, 2020 @08:13PM (#22912263)
odd golang has a better security story than npm, rubygems, and python. it'll at least crypto ensures the dependency code hasnt been modified since you first retrieved it iirc.

the rest is up to you as a developer to ensure its safe.

[ Parent | on HN ]