Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Nothing, in fact there have been many cases where python's and nodejs's package systems were exploited to achieve arbitrary code execution (because that's a feature, not a bug, to allow "complicated installation processes to just work").

https://arstechnica.com/information-technology/2021/12/malic...

AVs are the wrong way to go about security anyway, it's a reactionary strategy in a cat and mouse game by definition. For prevention, I think the BSDs are doing some promising work with the "pledge" mechanism. And as much hate as they get, I like appimages and snap et al for forcing people to consider a better segmentation model and permission system for installed software.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: