Hacker News Reader

Of course you should be concerned. You're installing a kernel extension from an unknown developer on the internet. Most people here are using npm which has thousands of malicious packages. I don't think they have a clue.

https://threatpost.com/malicious-npm-packages-web-apps/17813...

View on HN

Thanks for your input @flankk. Question, this isn't necessarily from a unknown developer, the download link is in fact dropbox unless Im misunderstanding the definition of an unknown developer. I suppose what Im really trying to understand is should we be trusting of dropbox? I know in the past they would circumvent apples sandbox via an exploit and they thought it was totally fine to do this gives me pause.

If the cask downloads directly from dropbox I would trust it. It's up to you who you feel comfortable trusting. If you have internal company stuff you don't want out keep it on a private intranet. This is the type of stuff Richard Stallman has talked about for years. It's a real problem but I'm afraid nobody listens.

This is why I use mega.co.nz for all the sensitive files of my business. Google and Dropbox get the files that I wouldn't mind if they were on a bulletin board. But this is not a common practice, and the risks aren't well-known by users.

This is perfect, thanks for sharing!

Reply on news.ycombinator.com