Data Science

  • 54 Posts
  • 326 Comments
Joined 1 year ago
cake
Cake day: June 17th, 2023

help-circle




  • Building from source is the opposite of hacky. It’s the recommended way to deal with things like this where you are concerned about trust and security. I understand that it’s not something you’ve done before, but it not as complicated as it sounds. There are many tutorials on how to build programs from source.

    I understand that providing official packages for fedora/rhel, Ubuntu/debian, and arch-based distro packages along with a flatpack and Appimage would make a lot of sense, but for whatever reason, signal has decided not to. Perhaps you can message the signal team to ask why they choose not to do this.



  • I’ve been comparing crates on crates.io against their upstream repositories in an effect to detect (and, ultimately, help prevent) supply chain attacks like the xz backdoor1, where the code published in a package doesn’t match the code in its repository.

    The results of these comparisons for the most popular 9992 crates by download count are now available. These come with a bunch of caveats that I’ll get into below, but I hope it’s a useful starting point for discussing code provenance in the Rust ecosystem.

    No evidence of malicious activity was detected as part of this work, and approximately 83% of the current versions of these popular crates match their upstream repositories exactly.