▲ 150 ▼ Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware (www.phoronix.com) submitted 3 months ago by Some_Emo_Chick@lemmy.world to c/technology@lemmy.world 28 comments fedilink hide all child comments
[–] FaceDeer@fedia.io 4 points 3 months ago (1 child) Unreliable is still a step up from completely absent. permalink fedilink source parent hideshow 1 child comment replies: [–] Tetsuo@jlai.lu 4 points 3 months ago Maybe. But an unreliable scanner means a human has to check all the false positives and false negatives which can quickly take a lot of time for projects that are run by benevolent devs. It's really important to keep in mind this is done for free and that supply chain attacks like this one are very hard to identify. I mean this is usually not the devs being careless, it's very complex attacks on projects with very limited ressources. Attackers even sometimes choose purposefully projects that are "understaffed" (well, more understaffed than others). permalink fedilink source parent
[–] Tetsuo@jlai.lu 4 points 3 months ago Maybe. But an unreliable scanner means a human has to check all the false positives and false negatives which can quickly take a lot of time for projects that are run by benevolent devs. It's really important to keep in mind this is done for free and that supply chain attacks like this one are very hard to identify. I mean this is usually not the devs being careless, it's very complex attacks on projects with very limited ressources. Attackers even sometimes choose purposefully projects that are "understaffed" (well, more understaffed than others). permalink fedilink source parent