The point of "... trusting trust" is not really the specific bug, but rather the observation that the whole supply chain matters. Built artifacts as exist on disk in the repo are a relatively small piece of that.
> None of those package repositories are maintained by a limited set of curators.
It's always interesting to me how few people seemingly know this. Python package maintainers realize how easy it is to add packages to PyPI, but many admins and even SOC operators inherently trust it because they think that it "must be reviewed by someone".
> None of those package repositories are maintained by a limited set of curators.
It's always interesting to me how few people seemingly know this. Python package maintainers realize how easy it is to add packages to PyPI, but many admins and even SOC operators inherently trust it because they think that it "must be reviewed by someone".
Also, there have been plenty of security issues with Ubuntu and Debian: https://wiki.ubuntu.com/UbuntuWeeklyNewsletter/Issue52#Commu... https://www.linuxinsider.com/story/32240.html
Also there have been bugs in apt: https://www.fosslinux.com/6167/massive-security-bug-found-in...
Also the official ISO from the Mint website: https://arstechnica.com/information-technology/2016/02/linux...
Also the AUR malware mentioned on thread: https://www.bleepingcomputer.com/news/security/malware-found...
Also the kernel.org compromise: https://www.zdnet.com/article/linux-kernel-source-code-repos...
Edit: let's throw in the redhat ceph intrusion while we're at it (note that this includes InkTank). https://www.zdnet.com/article/red-hats-ceph-and-inktank-code...