StarDreamer

Back in the BERT days I had a physics major friend that stuffed a bunch of Norwegian names in a file and trained a Norwegian name generator. He also made a Moby Dick sentence generator for funsies.

PewDiePie’s project is nothing different than a personal pet project like these cases. Nothing about being a YouTuber makes you an expert at machine learning. It should be treated the same way as any other pet project.

If the concern is someone with large amounts of influence causing disproportionate harm with their personal projects by name alone, at least in this particular case, I feel it’s appropriate to blame someone who trusts a YouTuber’s pet project in the first place.

deleted by creator

That still leaves two out of three questions unanswered. Most importantly the last one, which was addressed towards the original complaint.

1. If your assumption is that X509 is trash, does that mean you hold the same amount of distrust to TLS?
2. How do you propose the scaling of key management? Do you have a reasonable alternative to users blindly trusting every single key they come across?
3. Back to my original question: what prevents a VSCode extension from stealing a private signing key (as opposed to an API key) and causing the same issues described here?

And how would apt help in this particular case? A supply chain attack can happen with any particular package manager. In this case, the compromised package was detected and mitigated within 93 minutes, affecting a total of ~330 users. Which is a lot better than how a lot of distros handled the xz breach last year.

All reasonably secure package managers (and https) operate on a chain of trust. There is little that can be done if that chain of trust is broken.

Based on this the cause was a malicious VSCode extension that stole credentials that were later used to trigger a deployment CI/CD pipeline. If there’s anything to learn from this, it’s probably to not use VSCode.