Post by @pducklin@infosec.exchange

2026-09-27 13:44 UTC

RE: https://infosec.exchange/@bontchev/117337322796120995 Hahahaha. So the official download repositories of Julia and Rust are “open source crap,” but somehow the entire supply chain of dependencies that you invite into your world when running pip to grab some new packages is trustworthy? But, of course, “you know what you are doing,” because everyone else is some kind of idiot while you are not. Somehow you expect pip install to be safer than curlbash… when they are much more similar in terms of risk than they are different - basically, download a chain of stuff from the internet, unpack it into memory or onto disk or both, run what you get out, rinse, repeat until dependencies satisfied. Well, good luck with that. (To be clear, you really *do* need to get out more.)

Replies (1)

@bontchev@infosec.exchange 2026-09-27 15:56

@pducklin@infosec.exchange Strawman argument - you're deflecting the conversation. You are talking about supply chain compromise. This is a serious attack - I never said that only idiots fall for it. I said that only idiots fall for the ClickFix attack. It was again *your* argument that people type anything into the terminal because they are used to install stuff with "curl | bash". I countered that no mainstream product installs like this; they all have installers. Yes, installers and official repositories can be compromised - but that's a completely different issue. Just because it is possible has no effect on people typing random commands from web sites into the terminal without understanding them. Only idiots do that. You really *do* need to learn to read.

Open ##4905669