- cross-posted to:
- linux@lemmy.world
- cross-posted to:
- linux@lemmy.world
I suspect this was just a lucky catch of shit that happens all the time. Supply chain attacks are super scary and effectively impossible to eliminate in modern software development.
Obviously not impossible to spot, just the best reason for open source software
It’s almost impossible to spot by people looking directly at the code. I’m honestly surprised this one was discovered at all. People are still trying to deconstruct this exploit to figure out how the RCE worked.
And supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.
There are sysadmins that discover a major vulnerabilities though troubleshooting
The key is the number of people involved