Really cool applied research. If I get the time, I'll check out the author's thesis.
Typosquatting programming language package managers
11–20 of 148 posts
Re: Typosquatting programming language package managers
#12I'm a fan of the approach of personally submitting projects to the repository maintainer (e.g. through GitHub issues), and having the maintainer personally approve them. It does raise the barrier to entry, but it would prevent typosquatting and regular namesquatting. EDIT: Does any major package manager provide a "did you mean" functionality, offering a list of actual package names similar to what you typed?
That's a massive burden on the poor person who has to ok the package - especially at NPM's scale, for example.
Re: Typosquatting programming language package managers
#13I'm a fan of the approach of personally submitting projects to the repository maintainer (e.g. through GitHub issues), and having the maintainer personally approve them. It does raise the barrier to entry, but it would prevent typosquatting and regular namesquatting. EDIT: Does any major package manager provide a "did you mean" functionality, offering a list of actual package names similar to what you typed?
APT does and others probably do too, but it obviously only gives suggestions when the package you entered doesn't exist.
Re: Typosquatting programming language package managers
#14Reminds me of the quote, 'there are only two hard things in computer science: naming things, cache invalidation and off-by-one errors.' I think that this clearly falls under the heading 'naming issue.' People know what they want, but do not enter it properly. I can't think of a 100% off-hand, which isn't surprising, because it's a hard problem. pmontra's suggestion to use typo blacklisting ain't a bad idea. Maybe som…
Sure it's not an off-by-one[-key] error? :)
Re: Typosquatting programming language package managers
#15Reminds me of the quote, 'there are only two hard things in computer science: naming things, cache invalidation and off-by-one errors.' I think that this clearly falls under the heading 'naming issue.' People know what they want, but do not enter it properly. I can't think of a 100% off-hand, which isn't surprising, because it's a hard problem. pmontra's suggestion to use typo blacklisting ain't a bad idea. Maybe som…
Banks have a similar problem when people write cheques or set up standing orders. You have to put a name and the account number.
I wonder if you could do something similar here - enter the name of the package and a code of some sort. I haven't thought this through in a lot of detail.
Re: Typosquatting programming language package managers
#16Probably the maintainers of the package managers know which typos their users do, because of the 404s in the logs or equivalent errors. A preventive action could be starting to blacklist any name resolving to 404. If somebody eventually tries to upload a package in the blacklist, a maintainer should check the code and whitelist the name. Obviously people can be very crative with typos and with squattinq and there is…
Might it work to mandate that the name of an uploaded package have a minimum levenshtein distance (or similar calculation) from the names of all the existing packages? Then you wouldn't have to worry about maintaining a blacklist.
That would mean that, for example on crates.io, you couldn't create a `libm`, because `libc` is already very popular. I don't think that works.
Re: Typosquatting programming language package managers
#17Earlier quoted context omitted.
Might it work to mandate that the name of an uploaded package have a minimum levenshtein distance (or similar calculation) from the names of all the existing packages? Then you wouldn't have to worry about maintaining a blacklist.
That would mean that, for example on crates.io, you couldn't create a `libm`, because `libc` is already very popular. I don't think that works.
True- levenshtein isn't the best algorithm for the purpose. Is there an algorithm that takes key proximity into account? Like, 'libm' and 'libc' are sufficiently different to preclude typos, but 'lib[n/j/k]' or 'lib[x/d/f/v]' are not?
Re: Typosquatting programming language package managers
#18After watching this awesome Defcon talk https://www.youtube.com/watch?v=YqxaKGA9Lnc I wondered if there was any use cases for bit/typo squating in crypto. This is a pretty cool one! Not crypto but interesting none-the-less :)
Re: Typosquatting programming language package managers
#19Wow, this a very good study and explanation of what typo squatting is, and I really liked how he proved it's effectiveness. I wonder what kind of steps we can take to prevent this risk.
I think we will have to rely on crypto hash in some form. Similar to download checksum. It won't be convenient, but it will be safe(r).
Re: Typosquatting programming language package managers
#20This seems like pretty unethical research to me.
Also, doesn't point out that the bigger threat is that this is wormable.