3 points | by colinmarc 6 hours ago
1 comments
I debated putting this editorializing in the title, but:
At $work we've been refreshing the Bun release page for days, wondering when they would push the fix. The PR with the change merged over 72 hours ago: https://github.com/oven-sh/bun/commit/ea6a2c7b7c98862627760d...
I'm not a security expert, but package managers seem uniquely vulnerable to MITM attacks.
I don't really see the point of spending $MM in tokens to create a software factory if you can't push security releases out in a timely fashion.
I debated putting this editorializing in the title, but:
At $work we've been refreshing the Bun release page for days, wondering when they would push the fix. The PR with the change merged over 72 hours ago: https://github.com/oven-sh/bun/commit/ea6a2c7b7c98862627760d...
I'm not a security expert, but package managers seem uniquely vulnerable to MITM attacks.
I don't really see the point of spending $MM in tokens to create a software factory if you can't push security releases out in a timely fashion.