Comment Comment by rich_sasha Is that so? It would seem like any packaging solution that pulls dependencies from GitHub is vulnerable.This is the case for Rust, it seems. Or any GitHub-based project that pulls recursively submodules.Unless you have a curated, audited package repository, i can't see how you easily avoid it. Hence it is reasonable to ask how the OS can help. parent rich_sasha 3 years ago
This is the case for Rust, it seems. Or any GitHub-based project that pulls recursively submodules.
Unless you have a curated, audited package repository, i can't see how you easily avoid it. Hence it is reasonable to ask how the OS can help.