Nightly PyTorch builds compromised
Nightly PyTorch builds compromised
Posted Jan 6, 2023 14:04 UTC (Fri) by mw_skieske (guest, #144003)In reply to: Nightly PyTorch builds compromised by mbunkus
Parent article: Nightly PyTorch builds compromised
see: https://man7.org/linux/man-pages/man5/yum.conf.5.html
however this is not really a solution if you don't trust the controlling instance of a remote package server.
i.e. if ms vs code repo content or their signing get somehow compromised they can just replace the "code" binary which you maybe want from this repository to include malicious content.
on the plus side for the attacker this might be much harder to detect for end users.
fwiw the official ms package for fedora does not automatically set these restrictions and I'm not aware of many repositories that do something like this.
I believe this option is ultimately not a security option but more of a bandaid against accidentally installing a package from a wrong repository.
Posted Jan 6, 2023 21:23 UTC (Fri)
by NYKevin (subscriber, #129325)
[Link]
I doubt this is a solvable problem. You have to trust *somebody* (unless you want to download all of the source code and audit it by hand, in which case you should probably be using Gentoo instead of Debian), and in practice that probably has to be the packager, not the upstream (because the packager may have to carry patches or otherwise modify the software to be suitable for distribution). If you trust the packager, then you trust them, end of story. If you don't trust them, then you can't (shouldn't) run any software they give you.
Nightly PyTorch builds compromised