6 ms·
That might change the odds, but unless you fork diligently (and monkeypatch each and every future vulnerability) you might ship a compromised fork forever.
by repelsteeltje 4mo ago
That might change the odds, but unless you fork diligently (and monkeypatch each and every future vulnerability) you might ship a compromised fork forever.
- olejorgenb 4mo agoExcept most of the attacks so far has not landed actually source code changes to git IIRC. They have targeting the release files directly.
- lights0123 4mo agoSoftware vulnerabilities are often not placed maliciously, and are present in the original source. If you don't patch them if discovered later, you'll be vulnerable to them.
- olejorgenb 4mo agoYes. Isn't that "giant PITA" is referring to here? > your own repo reviewing and merging from upstream as needed. Would be a giant PITA though