• 1 Post
  • 98 Comments
Joined 2 years ago
cake
Cake day: March 25th, 2022

help-circle










  • I wonder what sort of mitigations we can take to prevent such kind of attacks, wherein someone contributes to an open-source project to gain trust and to ultimately work towards making users of that software vulnerable. Besides analyzing with bigger scrutiny other people’s contributions (as the article mentioned), I don’t see what else one could do. There are many ways vulnerabilities can be introduced and a lot of them are hard to spot (especially in C with stuff like undefined behavior and lack of modern safety features) , so I don’t think “being more careful” is going to be enough.

    I imagine such attacks will become more common now, and that these kind of attacks could become very appealing for governments.


  • When using git and are working on a feature, and suddenly want to work on something else, you can use git stash so git remembers your changes and is able to restore them when you are done. There is also git add -p this allows you to stage only certain lines of a file, this allows you to keep commits to a single feature if you already did another change that you didn’t commit (this is kind of error prone, since you have to make sure that the commit includes exactly the things that you want it to include, so this solution should be avoided). But the easiest way is when you get the feeling that you have completed a certain task towards your goal and that you can move on to another task, to commit. But if you fail you can also change the history in git, so if you haven’t pushed yet, you can move the commits around or, if you really need to, edit past commits and break them into multiple.





  • Faresh@lemmy.mltoMemes@lemmy.mlKnow your enemy
    link
    fedilink
    English
    arrow-up
    1
    ·
    7 months ago

    a shovel produces the same amount of use-value whether it is sold for $5 or $25

    Not disagreeing with anything you said, but use-value is a qualitative property of a commodity, not quantitative, so we can’t speak of an “amount of use-value”, AFAIK.