387 karma · joined June 25, 2018
A country where your actions are judged on whether they improve improve GDP or GDP/capita would be a terrible place to live.
"Haxx is a bunch of friends who work as software developers and hackers in Sweden"
Yep, that'll do it.
That is such a terrible argument because, for one, it ignores all the catastrophes that did happen in the last 300 years to various peoples.
You might say "aha! walking is not thinking", but surely you would think very hard about where to put your limbs if you were to walk through a minefield, etc. Is walking thinking if the conscious mind does it? So whether "thought" can occur unconsciously or not is a question of English not of neuroscience.
-ve Don't go outside
0s Wear a coat
10s Wear a jacket
20s Wear a t-shirt
30s Don't go outside
Alice installs malicious eslint.
Attacker has control of Alice's machine and signs a malicious version of Alice's package using Alice's key.
Attacker publishes a new version of Alice's package.
Bob installs Alice's (malicious) package.
Attacker has control of Bob's machine and signs a malicious version of Bob's package using Bob's key.
Attacker publishes a new version of Bob's package.
...repeat
IMO signing could only work if it were combined with 2FA so that each time a package is signed, the signing operation is verified by the user on a second device. Otherwise it doesn't really impede a worm significantly because the nature of this attack is that the maintainer's primary device gets completely owned. We are all very lucky that the eslint attack only stole npm credentials instead of installing rootkits.If working 48 hour weeks, 1 USD per hour is $208 per month, which is a modestly good wage in some places. Not really the minimum, although probably so for a very dirty and unpleasant job in a recycling factory.