News for hackers. Stuff that matters.

A comment on Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies. Parent comment

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by thombles on Wednesday February 10, 2021 @06:08AM (#26087743)
Not sure if serious, but I will point out this is significantly different. If I'm installing an application like homebrew or the Rust toolchain then I am explicitly giving them the right to code execution. It doesn't much matter whether they get it through the script on their website or the binaries downloaded from that website.

Random libraries, possibly pulled in by a dependency of a dependency of a dependency... not so much.

[ Parent | on HN ]
Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by hda2 on Wednesday February 10, 2021 @10:03PM (#26097789)
I know this is besides the point, but rust can be installed - without piping the output of a public-facing server into a privileged shell - by using their offline installer: https://forge.rust-lang.org/infra/other-installation-methods...

They offer PGP signatures too!

[ Parent | on HN ]