• 9 Posts
  • 41 Comments
Joined 2 years ago
cake
Cake day: June 12th, 2023

help-circle

  • Yes and no. The truth of the matter is supply-chain attacks in any repository are almost impossible to fully mitigate. The attack you linked sounds like a big and successful attack, but there are more minor attack attempts all the time. It’s the blessing and curse of every package manager that anyone can upload almost anything.

    The upshot is that the most active repos have the most eyes. Not to say an attack won’t fly under the radar, but if the React or Angular packages (or their dependencies) start acting weird, it’s more likely that someone will notice, as there are people dedicated to auditing such things.

    Furthermore, a lot of the smaller packages do “one thing” (see the infamous is-even package), so they are small and easy to self-audit if you are paranoid enough.

    It’s not perfect, and there will always be more headlines about the next big attack, but it’s still a boon overall IMO.




  • One thing you should do is grab your data for easy moving, you haven’t already.


    Assuming you’re using the default Lemmy web UI (not Voyager, or Photon, or a mobile app, or whatever), click on your username in the top right, and select “Settings”.

    On the settings page, there’s a section called “Import/Export Settings”. Click the “Export” button and let your browser download the file.

    Then, when you switch instances, you can go into the same Settings page on the new instance, select the file you downloaded, and hit “Import” and you will automatically be resubscribed to the communities you subscribed to.