Yeah. The burden is high, though, and it’s outside even most tech-savvy admins’ scope of knowledge.
I mean, I could not tell you off the top of my head how many certificate stores exist on my system and what uses each of them. Is curl safe? Is dnf safe? apt-get? zypper? pip? npm? homebrew? flatpak? Do any of my umpteen Flatpak apps have vulnerable library versions baked in? Do Electron apps bundle their own certificate stores? What about <random bullshit> that has its own built-in autoupdater (less of a problem on Linux than Mac or Windows, but still)?
Yeah. The burden is high, though, and it’s outside even most tech-savvy admins’ scope of knowledge.
I mean, I could not tell you off the top of my head how many certificate stores exist on my system and what uses each of them. Is curl safe? Is dnf safe? apt-get? zypper? pip? npm? homebrew? flatpak? Do any of my umpteen Flatpak apps have vulnerable library versions baked in? Do Electron apps bundle their own certificate stores? What about <random bullshit> that has its own built-in autoupdater (less of a problem on Linux than Mac or Windows, but still)?