Post #3314915
2026-06-14 07:35 UTC
Man I can’t believe what rabbit hole I am getting into. It indeed seems crazy, how can this be acceptable. How is it possible that nobody is concerned by this.
Replies (1)
-
@historicaldocuments@lemmy.world 2026-06-14 11:44
according to their stated security model, untrusted applications must not be allowed to communicate with the secret service. That won’t be a popular stance to take when someone eventually steals a bunch of cached, unlocked credentials off of D-BUS because of an oversight somewhere in the npm/aur/pip/cargo/whatever ecosystem. More rabbit hole: www.openbsd.org/papers/…/mgp00001.html gpg.fail (including the presentation) github.com/FiloSottile/age jedisct1.github.io/minisign/ github.com/jedisct1/encpipe