Conversation

Jonathan Corbet

Edited 14 days ago
Quote of the day (from the Fedora devel list):
We have no mechanism to flag when J. Random Packager adds "Supplements: glibc" to their random leaf node package. As a reminder, *we are a project that allows 1,601 minimally-vetted people to deliver arbitrary code executed as root on hundreds of thousands of systems*, and this mechanism allows any one of those people to cause the package they have complete control over to be automatically pulled in as a dependency on virtually every single one of those systems.
Adam Williamson
1
90
101
@corbet @tinker Huh. Does Fedora have worse processes than Debian?
0
0
0