The Apiiro research team has detected a repo confusion campaign that has evolved and expanded, impacting over 100k GitHub repos with malicious code.
  • delirious_owl
    203·
    8 months ago

    Friends dont let friends install software that isn’t signed.

    Use apt.

    • Pantherina
      120·
      8 months ago8 months ago

      Lol apt

      Or to frame it differently, use a package manager and not appimages etc.

      • delirious_owl
        41·
        8 months ago

        AppImages actually do have (optional) support for signatures.

        • Pantherina
          20·
          8 months ago

          They have no update feature afaik, how does this work? What verified this signature, the user?

          • delirious_owl
            20·
            8 months ago

            Its a subcommand of the AppImage. The developer adds the signature to the AppImage and the user verifies it after download with the subcommand.

            • Pantherina
              10·
              8 months ago

              Thats nice, didnt even know there was an interface for managing appimages?

    • andreas
      30·
      8 months ago

      I mean, yeah but not everything is available over apt. I try to use it whenever I can though