How to gain code execution on hundreds of millions of people and popular apps

Re:How to gain code execution on hundreds of millions of peo... by pixl97 on Friday February 28, 2025 @10:00PM (#43215265)

Ya too many people think it's a great idea to raw dog your ci/cd on the net and later get newspaper articles written about the data leak.

The number of packages that is malicious is high enough, then you have typo packages, and packages that get compromised at a later date. Being isolated from the net with proper monitoring gives a huge heads up when your build system suddenly tries to contact some random site/IP.

[ Parent | on HN ]

Re:How to gain code execution on hundreds of millions of peo... by turtlebits on Saturday March 01, 2025 @12:08PM (#43221292)

People don't think it's a great idea. In general, its just too much additional work/process - for very little benefit.

You're far more likely to encounter a security issue from adding/upgrading a dependency than your build process requiring internet access.

[ Parent | on HN ]