Hacker News Reader

If Jia Tan's PR was approved, malicious artifacts could go to github releases just as easily as in a tarball. Struggling to understand the point made about github releases being a security mitigation.

View on HN

When I did my first github "release" I was shocked that it involved picking files to upload...

And how many of these files have I downloaded over the years? :sob:

The real answer here is downloading a tarball generated from a tag - those are generated by the GitHub backend.

Reply on news.ycombinator.com