News for hackers. Stuff that matters.

A comment on The xz attack shell script. Parent comment

Re:The xz attack shell script by kelseydh on Wednesday April 03, 2024 @06:11AM (#39915482)
On open source projects you can vet people based on whether you can personally identify them as real people. Moving forward be suspicious of anonymity for core contributions.
[ Parent | on HN ]
Re:The xz attack shell script by not2b on Wednesday April 03, 2024 @11:59AM (#39919133)
Debian does things that way, their developers have to get their key signed by other developers, and a DD who signs someone's key is supposed to check ID. But there's no similar protection for their upstream.
[ Parent | on HN ]
Re:The xz attack shell script by xcrunner529 on Friday April 05, 2024 @09:05PM (#39949081)
And using a freaking VPN for everything. Definitely more vetting is needed.
[ Parent | on HN ]