What's coming in Meteor 1.2, and beyond

Re:What's coming in Meteor 1.2, and beyond by honest_joe on Wednesday July 01, 2015 @10:16AM (#9811925)

Commit a race condition to glibc,musl,uclibc and fuck up almost every software on the planet.

It's convenient and that does not mean it's a good practice but i doubt using an other method would minimize a risk when the meteor.com would actually get owned.

[ Parent | on HN ]

Re:What's coming in Meteor 1.2, and beyond by sarciszewski on Wednesday July 01, 2015 @10:17AM (#9811945)

> i doubt using an other method would minimize a risk when the meteor.com would actually get owned.

GPG signing, keep the private key offline, publish the public key in the blockchain and have a lot of high profile technologists sign it so it can be independently verified.

(They provide an example shell script for quickly downloading and verifying the latest versions of their install)

[ Parent | on HN ]

Re:What's coming in Meteor 1.2, and beyond by honest_joe on Wednesday July 01, 2015 @10:25AM (#9811990)

I completely understand your point.

But at the end it's about people ...your example with PHPUnit can be abused like this https://thejh.net/misc/website-terminal-copy-paste How many people do you think will bother to paste the script to a text editor and check for evil parts ?

[ Parent | on HN ]

Re:What's coming in Meteor 1.2, and beyond by sarciszewski on Wednesday July 01, 2015 @10:29AM (#9812020)

Anybody who runs unverified code, through any medium, when the option to run trusted code is available, deserves to get pwned.

https://github.com/paragonie/password_lock/blob/master/run-t...

^- For the record, I keep scripts like this in my Git repositories.

[ Parent | on HN ]