@wxcafe@social.wxcafe.net human trusts in their $PATH to be nonpoisonous?
how funny
@lanodan_tmp @wxcafe@social.wxcafe.net people accidentally type their passwords into their shells and don't scrub it from ~/.[shell]_history i think expecting people to check that is asking a bit
Follow
@lanodan_tmp @wxcafe@social.wxcafe.net also, you didn't consider the possibility of "which where when why" all also being poisoned
once a competent enough attacker has control of your ~/.[shell]_profile, all they have to do is wait for you to mess up
@boots @wxcafe
which which
/usr/bin/which which
where which
which where
And so on, also if you’re like… uh what about compilers and not trusting binairies there is something about that too in reproductible builds.