Notices by Martin Ueding (martin_ueding@bonn.social)

@parismarx
I mean there is one additional step: Using all people's e-mails to train models …

@kirschwipfel @lispi314 @AndresFreundTec @glyph
Sounds good. But some projects have a build stage which generates lots of things. Packagers for distributions need to set up the needed environment and perform these steps. It seems much easier to use a provided artifact in these cases.

I think this attack is hard to defend against: An evil insider in the project with control over the code and artifacts. One could also hide malicious stuff in the code itself directly, in plain sight.