Re:Timeline of the xz open source attack
by duped on Thursday April 04, 2024 @04:32PM
(#39935463)
The fundamental difference is that processes are used to sandbox sections of the program that run untrusted code. A subroutine from a library isn't untrusted code.
Having written multi-process programs used for this purpose, I disagree that it's simple or traditional for the purposes of hardening against supply chain attacks in shared libraries. Only at the most naive level is it appropriate.
And on top of that, it would not have prevented the backdoor. It would only have changed the mechanism used to invoke it.
Having written multi-process programs used for this purpose, I disagree that it's simple or traditional for the purposes of hardening against supply chain attacks in shared libraries. Only at the most naive level is it appropriate.
And on top of that, it would not have prevented the backdoor. It would only have changed the mechanism used to invoke it.