Hacker News Reader

nearly everything talks dbus, even browser extensions.

It’s even more serious than running untrusted shell scripts.

That's not the problem. The real problem is that if I convince you to run my script, it's going to be quite easy to convince you to give me extra permissions, so I can get to your data. It really irks me when things like Cargo are doing exactly that, make me run a sh script. Cargo and the likes, are making running sh scripts way too common.

I assume you mean rustup, not cargo specifically or am I wrong?

cargo builds/runs build.rs in the background

Yeah, that was a brain fart.

browser extensions? you mean like Chrome ones etc? never heard of that being a thing

plasma integration and gnome-shell integration do, and those are open source so you can see for yourself.

It’s also very common for password manager extensions like 1password and bitwarden.

Reply on news.ycombinator.com