Maybe this is overly naive, but when I make a typo in the Google search bar, it doesn't even search for my typo-ed term (even if it would have gotten some hits), it searches for what I actually meant to type. Can't package managers have a similar feature?
Typosquatting programming language package managers
81–90 of 148 posts
Re: Typosquatting programming language package managers
#82Instead of blacklisting, why not respond with a "You requested package ABD, but we think you might mean package ABC. Enter 'yes' to continue or anything else to start over." That way authors can continue to use any name they want, and the emphasis is on letting installers know that they might be installing the wrong package.
But if ABD and ABC are both package names in the system, then in order to present that warning we have to do some sort of resolution process to determine whether one is typosquatting.
Now that there's a strategy for finding fakers: 1) You have an attacker-defender arms race. The attacker will always be one step ahead of the defender. 2) You have the extra burden of keeping up in this race, otherwise your security feature is a facade. At best, this is useless. At worst, it lulls your users into a false sense of security.
Re: Typosquatting programming language package managers
#83This seems like pretty unethical research to me. Also, doesn't point out that the bigger threat is that this is wormable.
The doc (http://incolumitas.com/data/thesis.pdf) does have a short section on ethics, but IMHO it completely misses the point of the ethical concerns in running unauthorized, non-sandboxed code on devices you don't own. Instead it justifies the research by saying the threat cannot be shown unless the vulnerability is exploited, which is true, but that fact does not justify the research.
The acknowledgements mention 2 of the university advisers and a PyPi admin consented to the "notification program".
Still, people with good intentions have been prosecuted and convicted for less. I would be very concerned for this student.
Re: Typosquatting programming language package managers
#84Maybe this is overly naive, but when I make a typo in the Google search bar, it doesn't even search for my typo-ed term (even if it would have gotten some hits), it searches for what I actually meant to type. Can't package managers have a similar feature?
The main problem is when you really did mean to search for the typo term. There's no inherent problem in two packages having similar names.
Consider the following:
requests - a python package for making HTTP requests. requestr - a python package for a fictional startup that allows you to send requests to your nearest and dearest.
Given they both could be typos of each other:
1) How do we determine which one to use? What if someone accidentally also tries "requestd", somewhere between the two ?
2) How do we apply the principle of least surprise - I asked to install requests, and everything installed just fine, but now I can't import it?!
Re: Typosquatting programming language package managers
#85Earlier quoted context omitted.
This is all half of a much larger problem, which is package identification. Perl 6 specced out[1] quite a bit of a future system to handle a lot of this, and I believe a lot of it is now implemented. A few things you need to consider: - Maintainership can change over time. - Multiple people may trade off releasing a package, but it's still the same package. - There may be multiple repos (consider you may want to run…
Those are some good points, and I guess in my head I'm thinking of how Github does repos on their site as my "example". Github allows transferring of repos to another "namespace" (username), and will even forward requests from the old one to the new one for a while (how long i'm not sure...) Thinking about it a bit more that kind of "mutability" might not be the best idea in a package manager... Still, i think the na…
I'm not arguing for no namespaces, much the opposite. I'm arguing that the whole way most languages implement modules is fairly haphazard, and that that leads to this problem. If you review the link I included previously, you can see some examples of how you could definitively specify a particular module version. E.g.
use OldDog:name:auth:ver;
Re: Typosquatting programming language package managers
#86Instead of blacklisting, why not respond with a "You requested package ABD, but we think you might mean package ABC. Enter 'yes' to continue or anything else to start over." That way authors can continue to use any name they want, and the emphasis is on letting installers know that they might be installing the wrong package.
But if ABD and ABC are both package names in the system, then in order to present that warning we have to do some sort of resolution process to determine whether one is typosquatting. Now that there's a strategy for finding fakers: 1) You have an attacker-defender arms race. The attacker will always be one step ahead of the defender. 2) You have the extra burden of keeping up in this race, otherwise your security fea…
I feel like "pick the more popular package" is a good enough solution in this case.
Re: Typosquatting programming language package managers
#87We've gotten flack from package developers submitting new packages to Package Control [0] because all additions to the default channel are hand reviewed. Part of this process is to prevent accidentally close package names, to try and encourage collaboration and to encourage developers to actually explain what their package does and how to use it. My hope is to be automating a large amount of the review in the next fe…
Hey Will, Thanks for keeping Package Control high quality, I know it's highly appreciated :-)
Another grateful Package Control user here.
Re: Typosquatting programming language package managers
#88This only seems to be an issue for languages where packages reside in a global namespace, like Python, Rust etc. I think most languages these days are a bit smarter and avoid this beginner mistake (for various reasons).
This is obviously not true. If `serde` resided at `erickt/serde` (as the counterproposal for Rust would've had it), I could create `erict/serde` or `erick-t/serde` or any other variations of erickt's handle. The only way this is 'solved' is if some third party authority hands out top level names and refuses to register names that are similar to other names for some definition of similar. The number of levels between…
Well, you could also solve it by saying that the post slash names are unique. ie. There can't exist zardeh/serde if erickt/serde already exists. Then the author-name works as a logical checksum, and you aren't any worse off than you were with a global namespace.
Re: Typosquatting programming language package managers
#89Maybe this is overly naive, but when I make a typo in the Google search bar, it doesn't even search for my typo-ed term (even if it would have gotten some hits), it searches for what I actually meant to type. Can't package managers have a similar feature?
The main problem is when you really did mean to search for the typo term. There's no inherent problem in two packages having similar names. Consider the following: requests - a python package for making HTTP requests. requestr - a python package for a fictional startup that allows you to send requests to your nearest and dearest. Given they both could be typos of each other: 1) How do we determine which one to use? W…
$ pip install requestr
Package "requestr": did you mean "requests"? [Y/n]
(reason for this warning: similar spelling and requests is much more popular)
Pass --no-spell-warnings to disable this feature.Re: Typosquatting programming language package managers
#90Earlier quoted context omitted.
Or someone needs to approve suspiciously named packages.
How do you determine what is a suspicious package without reviewing every new package by hand?
You could base it off edit distance with all the other packages. If the distance is too close, then it needs manual approval.