11–20 of 119 posts
One nice thing about languages like C is that a lot of programmers just avoid dependencies because dealing with them kind of sucks. That's one solution to this problem.
One nice thing about languages like C is that a lot of programmers just avoid dependencies because dealing with them kind of sucks. That's one solution to this problem.
How do you check if you are affected?
The advisory has a regex, but it's not formatted well for copy-paste (non-ASCII quotes!). Here's a version that works: pip list –format=legacy | egrep ‘^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) ‘
One nice thing about languages like C is that a lot of programmers just avoid dependencies because dealing with them kind of sucks. That's one solution to this problem.
How do you check if you are affected?
There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable.
If some developers like this sort of unsafe practice it should be strictly limited to their machines and in no way make it across in any form as a deployment artifact.
There are already secure distribution package managers with the necessary infrastructure, you are not special, use those. Ruby is already paying a price for imposing dependency hell of users and wasting millions of man hours. Many have suffered and do not even bother with Ruby apps anymore. Node and others who think this is a good model will be next. Users should simply boycott such user hostile developers and languages that encourage this kind of insecurity.
Hi bro :)
Welcome Here!
Leave Messages via HTTP Log Please :)
On 2017-09-16:
Happy to see somebody find it ! :)
Just curious about how long it would take for people to find those 'bad' packages
As you see, that's just a toy script, no harm, hope you enjoy it !
Earlier quoted context omitted.
The advisory has a regex, but it's not formatted well for copy-paste (non-ASCII quotes!). Here's a version that works: pip list –format=legacy | egrep ‘^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) ‘
It appears that your version has non-ascii quotes as well.
pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '
works for me
The casual culture of pulling in hundred of dependencies, and mushrooming language specific package managers is ridiculously insecure and has to go. There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable. If some developers like this sort of unsafe practice it should be strictly limited to their machines and in no way make it across in any form a…
What's worse is that I skimmed the tree to check for anything particularly heinous, but there was nothing that stood out as unneeded.
With such a tiny stdlib, especially out of the browser environment, there's not really a better alternative than to make it easy to include dependencies for your dependencies. Without NPM, the Node community would be tiny if not already dead.
I don't have a better idea either. For my purposes, it just means I use a different language, but that's not really a solution.