Tomasz Kłoczko wrote:
Just FTR. If Fedora maintainers will decide to put ~/.local/bin over /usr/bin on the $PATH it will be possible to control over ~/.local/bin/id (and/or many more similar commands) what happens on begin of the user login session. None of the packages updates (except that one which will remove ~/.local/bin/ from the $PATH) would be able to stop damage ones done.
Would you consider now classify such change as serious vulnerability introduction?
If you state a falsehood again and again it will eventually become true?
Björn Persson