Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by christophilus on Wednesday February 10, 2021 @12:20PM (#26092019)

Honestly, it’s one of the things that makes me nervous about running Linux on all of my computers. At least with Windows (and probably OSX), my updates come from a single vendor who has strict internal code audits and security requirements. With Linux (I’m using Pop), my updates come from a package manager with a crapload of packages, each maintained by a different team / group with no central policy. There’s no way the small team at Pop can review and audit all of the things in the apt package system, and there have to be plenty of maintainers of popular packages who get sweet offers to sell out.

Anyway. I’m sticking with Pop / Linux. But it does make me nervous!

[ Parent | on HN ]

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by danhor on Wednesday February 10, 2021 @05:49PM (#26095886)

At least with windows, the drivers aren't checked that much and accordingly, have had some serious issues.

I'd guess distros are generally better off in that respect, but kernel space & user space aren't that different nowadays, when caring about your own security

[ Parent | on HN ]

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by jonny_eh on Wednesday February 10, 2021 @12:36PM (#26092229)

For Linux, it's about choosing a distro you can trust. Most manage their own repos, some more carefully than others.

[ Parent | on HN ]