Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by peteretep on Wednesday February 10, 2021 @05:21AM (#26087470)

You say this, but I feel like in the 20-odd years I’ve been using package managers I’ve seen very very few real world exploits?

[ Parent | on HN ]

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by dspillett on Wednesday February 10, 2021 @06:00AM (#26087693)

While the risk is low, the potential impact of a successful exploit is massive so the matter should be taken seriously.

Remember how much was temporarily broken in the leftPad event? Imagine if all that had been silently back-doored instead?

[ Parent | on HN ]

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by Cthulhu_ on Wednesday February 10, 2021 @05:32AM (#26087542)

Consider yourself lucky I guess? I mean in the 20-odd years I've been driving I've never had an accident either.

[ Parent | on HN ]

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by hanselot on Wednesday February 10, 2021 @05:26AM (#26087504)

Why would the ones getting away with it bother publishing articles about it? Rather, 20 years is a plenty long enough time to cover your tracks.

[ Parent | on HN ]