5 ms·

This response seems disingenuous. It was never implied it was ok to have exploits in the compiled software, only that the blast radius is smaller if the compile

• hnlmorg 26d ago
  Smaller maybe. But it’s still an unacceptable risk. I refer you back to my example of compiled code being used by customers. Arguing that compromised code is safer when sandboxed really misses the real problem: that you’re running compromised code in the first place. Hence my analogy of closing the barn door after the horse has already bolted. What we need is to ensure we have stronger safeguards in place to prevent bad code from reaching build pipelines. If it’s in the build pipelines then we’ve already lost. I get why people argue about sandboxing, it’s an easier problem to solve. But you still end up with a compromised artefact which you cannot ship. So the benefit is negligible.