Malicious code added to 35k GitHub repos, leaking user environments

Re:Malicious code added to 35k GitHub repos, leaking user en... by jollybean on Wednesday August 03, 2022 @04:02AM (#32328900)

What is the difference between a 'random' and 'non random' repo?

The whole point of 'Open Source' is that we can use code which might otherwise be a bit 'random'.

It's not 'Institutionalized Open Source' it's just 'Open Source' i.e. we're not all Torvalds.

So, credibility etc. is a very fickle thing otherwise, this is a serious security issue and we really don't have answers.

We used to think about code as 'logic that works' but now we have other criteria, I wonder if our FOSS models need to adapt bit.

[ Parent | on HN ]

Re:Malicious code added to 35k GitHub repos, leaking user en... by drekipus on Wednesday August 03, 2022 @09:11AM (#32331226)

It's a good point actually.

I suppose the message is "read the code you're using" but that is hard for big libraries and frameworks.

Obviously using one's code where they are impersonating someone else is a big red flag.

[ Parent | on HN ]

Re:Malicious code added to 35k GitHub repos, leaking user en... by jollybean on Wednesday August 03, 2022 @03:52PM (#32336027)

Reading the code for functional integrity is already a big deal, but having to sleuth around for the sneacky hacks? No way.

I don't know what the answer is, but the model has to be changed.

[ Parent | on HN ]