@historicaldocuments@lemmy.world
Post #3315919
2026-06-14 11:44 UTC
according to their stated security model, untrusted applications must not be allowed to communicate with the secret service.
That won’t be a popular stance to take when someone eventually steals a bunch of cached, unlocked credentials off of D-BUS because of an oversight somewhere in the npm/aur/pip/cargo/whatever ecosystem.
More rabbit hole:
www.openbsd.org/papers/…/mgp00001.html
gpg.fail (including the presentation)
github.com/FiloSottile/age
jedisct1.github.io/minisign/
github.com/jedisct1/encpipe
Replies (1)
-
@dieTasse@feddit.org 2026-06-14 12:49
Who defines the untrusted applications though? Thank you for the links! Btw I found out its the same on all major systems, on Windows as well as on MacOS (there they have credentials per app, but its easily spoofable for the same reason why GNOME refuses to even implement this).