Hacker News Reader

Any APT repo can push any package, e.g. this repo can give you a backdoored bash package

Sometimes repositories have duplicated packages, I'd be surprised if packages in earlier named repos didn't have precedence over later named repos. Meaning Microsoft couldn't just replace bash.

Reply on news.ycombinator.com