jsoref_using_a_screen_reader

jsoref_using_a_screen_reader, 2 months ago

@DoctorDNS @bagder I don't understand how this would help.

The attacker was the entire active ecosystem at the time. They chose to deliver the final payload as a source tarball instead of a git commit because they appear to have chosen to target distributions that were consuming the tarballs. But that was a decision of the attacking organization based on their targets' operational practices.

jsoref_using_a_screen_reader, 2 months ago

@stepheneb @DoctorDNS @bagder I'm aware. The message to which I replied didn't say "recompile from git sources"...

But even if it did. The other half of my post stands: the attackers will choose a model based on their target (here the distributors).

In this case, they assembled their attack using one git repository and one source code change in a "source archive". They could in a future attack distribute the components across multiple disparate components with seemingly unrelated maintainers.

jsoref_using_a_screen_reader, 5 months ago

@Tusky the widget reachable in #TalkBack after the available profiles is "Edit profile", it skips right over the disclosure row.

[Screenshot of 🦣 Tusky running on a Google Pixel 6a] [Menu on the left side of the screen covering content area:] Josh Soref (w/screen read…