Collaborate Disseminate
Microsoft’s open-source shopping spree has claimed another victim: npm. [Nat Friedman], CEO of GitHub (owned by Microsoft), announced the move recently on the GitHub blog.
So what motivated the acquisition, and what changes are we likely to see as a result of it? There are some obvious upsides and integrations, …read more
Continue reading What Does GitHub’s npm Acquisition Mean For Developers?
I want to install homebrew in the safest possible way (single user system). It is often criticized that homebrew takes precedence over /usr/bin and /bin (in /etc/path) and therefore any malware can simply put binaries or libr… Continue reading Security implications of homebrew
sudo dpkg –configure -a
gave this error down below
dpkg: error: unable to access the dpkg database directory /var/lib/dpkg: No such file or directory
tried
sudo rm /var/lib/dpkg
and
ps aux | grep -i apt
also lsof /var/li… Continue reading unable to access the dpkg database directory /var/lib/dpkg: No such file or directory [on hold]
I have been introduced to the anti-bash-script-piping stuff such as these:
Curl Bash Piping Wall of Shame (link broken)
Piping curl to s(hell)
Don’t Pipe to your Shell
The hidden dangers of piping curl and how to protect yo… Continue reading The most secure way to allow downloading and installing an app on Mac, Windows, or Linux
When building Docker containers I scan them with tools like Snyk and Clair. They identify vulnerabilities such as CVE’s in out of date packages in the underlying OS of the container.
How can I update these packages within th… Continue reading Keeping Docker containers up to date [migrated]
In 2017 and 2018 there were these infamous stories about malicious packages being uploaded to the PyPI (Python Package Index) which tried to do all sorts of things (collecting and sending data, reverse shells etc) during inst… Continue reading Is it possible to block non-PyPI requests during pip install?
If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority?
Edit: when using WebPack you should use NPM-packages (with a lot of their… Continue reading How secure is WebPack?
I have been recently alerted about https://blog.packagecloud.io/eng/2018/02/21/attacks-against-secure-apt-repositories/ .
The site claims that “Acquire::AllowInsecureRepositories” is enabled by default and this option causes … Continue reading Debian repository security: Is switching mirrors dangerous?
This question already has an answer here:
What are the security implications of homebrew and macports?
1 answer
I read (h… Continue reading How Homebrew may impact your Mac’s security [duplicate]
When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities for these dependencies. B… Continue reading Is it OK to not update devdependencies?