Re:How to take over the computer of a Maven Central user
by weavejester on Monday July 28, 2014 @08:44PM
(#8100113)
Leiningen also uses Clojars over HTTPS by default, I believe, so even without a web of trust, Clojars is still more secure than Central.
[ Parent
| on HN ]
Re:How to take over the computer of a Maven Central user
by technomancy on Monday July 28, 2014 @10:27PM
(#8100406)
Technically true, but practically this doesn't mean anything.
No one uses Clojars on its own, so if an attacker were able to perform a MITM attack, they could inject a spoofed library into the connection to Central even if the library should be fetched from Clojars.