Re:The modern packager’s security nightmare
by lucideer on Sunday February 21, 2021 @04:47PM
(#26217574)
> The universe I'd like to live in is where the only use case for dynamic linking are OS vendor APIs and cryptographically secure functions like TLS. My dream package manager would whitelist those system librarie and forbid distribution for any bundle that does contain the shared objects with the symbols it needs.
This idea seems to be predicated on a belief that OS vendor APIs and cryptographic libraries are the only attack surface for serious user-affecting software exploits.
Re:The modern packager’s security nightmare
by hctaw on Sunday February 21, 2021 @05:16PM
(#26217827)
They're obviously not, but they're the ones that package managers can help mitigate automatically. The rest is going to be up to the developers to patch.
This idea seems to be predicated on a belief that OS vendor APIs and cryptographic libraries are the only attack surface for serious user-affecting software exploits.