I’m worried even some random package like fastfetch getting compromised. I never installed that, it came with CachyOS, and it’s an “official package”. Does anyone actually check all 70+ packages that update per week? I dunno, it gives me the same uneasy feeling when I first was introduced to NPM
Well, there’s a difference between that and NPM, which is that there are some manual steps involved. There’s no standard way to “push an update to every distribution in existence”, you just put out a sign somewhere saying “hey, new release” then everyone has to look at it and package it in whichever way they feel appropriate, oftentimes to a “testing” space first before the “regular” one. Some random Gentoo user who rebuilt just same day would notice way before Alpine stable people, for example.
Even Jia Tan wasn’t too successful, their backdoor only functioned when in a small set of distributions (Debian…) and yet got noticed almost right away.
The only major malware that isn’t for the big 4 right now are:
ones that are preinstalled in IoT and “smart” devices
targeting said devices with remote holes (ironically sometimes made available by the preinstalled malware)
I’m worried even some random package like
fastfetchgetting compromised. I never installed that, it came with CachyOS, and it’s an “official package”. Does anyone actually check all 70+ packages that update per week? I dunno, it gives me the same uneasy feeling when I first was introduced to NPMWell, there’s a difference between that and NPM, which is that there are some manual steps involved. There’s no standard way to “push an update to every distribution in existence”, you just put out a sign somewhere saying “hey, new release” then everyone has to look at it and package it in whichever way they feel appropriate, oftentimes to a “testing” space first before the “regular” one. Some random Gentoo user who rebuilt just same day would notice way before Alpine stable people, for example.
Even Jia Tan wasn’t too successful, their backdoor only functioned when in a small set of distributions (Debian…) and yet got noticed almost right away.
The only major malware that isn’t for the big 4 right now are: