undefined | Better HN

0 pointsgpm1y ago0 comments

It would mean rebuilding more packages. I don't think that's meaningfully "much worse", package mangers are perfectly capable of rebuilding the world and the end-user fix is the same "pacman -Syu"/"apt-get update && apt-get upgrade"/...

On the flip side the elegant/readable build system means that the place this exploit was hidden wouldn't exist. Though I wouldn't confidently say that 'no hiding places exist' (especially with the parts of the ecosystem that wrap dependencies in other languages).

0 comments

ok1234561y ago

It's much worse because it requires repackaging every affected system package instead of a single library. Knowing which packages are affected is difficult because that information isn't exposed to the larger system package manager. After all, it's all managed by the build system.

packetlost1y ago

In the era of modern CI and build infrastructure, I don't really think that's materially an issue.

ok1234561y ago

Those CI and build infrastructures rely on the Debian and RedHat being able to build system packages.

How would an automated CI or build infrastructure stop this attack? It was stopped because the competent package maintainer noticed a performance regression.

In this case, this imagined build system would have to track every rust library used in every package to know which packages to perform an emergency release for.

2 more replies

j / k navigate · click thread line to collapse

0 pointsgpm1y ago0 comments

0 comments

ok1234561y ago

packetlost1y ago

In the era of modern CI and build infrastructure, I don't really think that's materially an issue.

ok1234561y ago

Those CI and build infrastructures rely on the Debian and RedHat being able to build system packages.

How would an automated CI or build infrastructure stop this attack? It was stopped because the competent package maintainer noticed a performance regression.

In this case, this imagined build system would have to track every rust library used in every package to know which packages to perform an emergency release for.

2 more replies

j / k navigate · click thread line to collapse