raesene5

Unfortunately what I've found is that it re-appears when you upgrade Firefox, which is annoying.

Likening Kickstarter to an investment has always concerned me. Investment implies a return if the idea is successful and (as you can see from Oculus Rift) early kickstarter backers didn't get any of the very large payout that Oculus got when the were bought by Facebook.

We're starting to see that idea come about with platforms like https://www.seedrs.com/ where if it goes swimingly the backers do well out of it, which kind of offsets the risk.

I think the problem with standard crowd-funding is the people doing the project obviously have an interest in downplaying the risks, and the platform does too, so with no regulation that's exactly what'll happen, and then we get a lot of very late, underdelivering projects which will sour people on the whole concept.

Err, you saw the bit where it's not Craigslist's money that's being donated, but the settlement that they got from 3Taps right?

And the bit where a very dubious interpretation of the CFAA which is opposed by the EFF was used as the legal basis to sue 3Taps...

I'm not OP, but my opinion would be that APT does do some things better than npm etc but there's still some potential problems.

Probably one of the most obvious is that access to the repos is over unencrypted HTTP connections which opens the process up to tampering (depending on the attacker) for example injecting an older version of a package with a known security issue.

cool. If you're looking for thoughts about threat models and ways to do it http://theupdateframework.com/index.html seems to have some good info.

that's interesting. Any pointers to package stores that do a better job on security? I'm researching the area a bit at the moment and I've not seen a lot of good practice out there, so would be interesting to have some good examples to hold up.

This is a problem with most/all lib installers. They tend to have hooks to allow post-install actions and those hooks tend to be able to run OS commands, with the privileges of the installing user.

Of course what's extra worrying is it's not just the libs you directly install, but all their dependencies which get to carry out these actions. So for example when you install rails, it will install quite a large number of subsidiary gems.

Then when you add in the fact that the credentials that control dev access to push to places like rubygems and npm are just static username/password combos (which sometimes get stored in plain text in a dot file in the developers home dir) and that there's no common use of digital signing for issued libs (in some cases the installers don't even support it).

from ICANNs site, looks like .google has been delegated (https://gtldresult.icann.org/application-result/applications... ), so I'd say yep that'll happen.

AFAIK google have applied for a large number of TLDs, this is one of them