Hacker News Reader

My preferred hypothetical installer Trojan method is to make it append a value to ~/.ssh/authorized_keys and then ping a C&C server with the current username and IP ;)

View on HN

You would still have to hope that sshd is enabled and accepting connections (which by default it shouldn't, at least on end-user distros).

True. I've mostly seen PHP devs using this to deploy composer onto staging and production servers, so it would work on them. ;)

Reply on news.ycombinator.com