Over 100k Infected Repos Found on GitHub

Re:Over 100k Infected Repos Found on GitHub by boringg on Thursday February 29, 2024 @09:10AM (#39549471)

Stupid question here -- whats the most efficient way to evaluate for vulnerabilities (i.e. remove the low level risk like 95% of the cases)? Is it trust the package manager or is there another quick way?

[ Parent | on HN ]

Re:Over 100k Infected Repos Found on GitHub by keepamovin on Thursday February 29, 2024 @11:01AM (#39551134)

Like 0ther folks say elsewhere in these threads, the most efficient way is not to eval for vulns, but to assume compromise.

So, folks adopt the (admittedly ridiculous, but, in the strict sense, necessary) 0-trust step of running everything in QubesOS, then in a VM, and maybe then in Docker.

Essentially each application gets its own fresh OS to fuck up or not...as it goes.

I get this (but I don't condone it). It's not practical for dev purposes, only if you are endlessly testing the waters for each little thing. But, prolly, eventually we will be wowed by a shiny-thing that achieves infinity-virtualization with bare metal performance but perfect isolation so we can easiily run

  infinvm run github.com/malware/repo

And all will be right with the world.

We ain't there yet tho. Hahaha :)

[ Parent | on HN ]

Re:Over 100k Infected Repos Found on GitHub by bee_rider on Thursday February 29, 2024 @10:29AM (#39550634)

I’d love to be surprised, but I think there isn’t any way to evaluate for vulnerabilities other than read all the code (fairly carefully). I don’t think the ecosystem is set up to make it easy.

[ Parent | on HN ]

Re:Over 100k Infected Repos Found on GitHub by s9df898r32h on Thursday February 29, 2024 @09:10PM (#39557733)

That's wrong because even coders can't write code without vulnerabilities inside their own software...

You probably instead should use a throwaway computer (or VM if you trust them), and not do anything personal on that computer, and then burn it.

[ Parent | on HN ]