News for hackers. Stuff that matters.

A comment on Real-world stories of how we’ve compromised CI/CD pipelines. Parent comment

Re:Real-world stories of how we’ve compromised CI/CD pipelines by snovv_crash on Monday January 17, 2022 @05:47PM (#29972575)
Now try this with eg. OpenCV, or ONNX, or tflite, or a million other packages that try to download additional information at compile time.
[ Parent | on HN ]
Re:Real-world stories of how we’ve compromised CI/CD pipelines by inetknght on Monday January 17, 2022 @07:40PM (#29973455)
Well there's you're problem; you're using packages written and maintained in an unsustainably insecure way.

It's been my experience that usually pull requests which make a library capable of being built offline are welcome. Usually. So get off your duff and get to fixing the problems in the free packages you use.

[ Parent | on HN ]