• 4 Posts
  • 112 Comments
Joined 10 months ago
cake
Cake day: September 7th, 2024

help-circle















  • Sure, in many cases the dev’s computer is powerful enough to handle that.

    However:

    • The more the dependencies, the more likely it is to pull-off a supply chain attack. Any of those thousands modules can be compromised and infect either the user or the developer.
    • Not all computers are optimized for working with so many tiny files. Have you ever worked in a company that uses McAfee Antivirus? Even Defender can be a massive performance hit in some cases.

  • I had read about it on another thread, which was about using old smartphones as servers (they used Termux).

    Those old lithium batteries, although sometimes seemingly healthy, can catch fire any time. Having them connected to the charger 24/7 is only making matters worse.

    I wouldn’t trust the battery of old devices. I would probably buy a used UPS (without battery) and slap a new battery to it. This would cost more, but it would allow me to also connect other important devices to it - like the router and some lights.




  • It’s the first time I see the concept of bootstrappability in the context of security.

    Is it really worth the effort?

    There are multiple ways to run a supply chain attack. With bootstrappability, one can be sure that the compiler is trusted, but what about the code that the compiler compiles? There was this recent attack to XZ utils, which shows that more attention is needed on the code being merged and compiled.

    I think that this just creates a false sense of security.

    Contrary to that, I had read about a BSD team (I think FreeBSD) that reviews all the code before each release. This way they have achieved ~5 RCE exploits throughout their entire history.