Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Devs unknowingly use “malicious” modules snuck into official Python repository

arstechnica.com

Post reply on HN
Print view View original

81–90 of 119 posts

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#81

Post by Nursie »

yeukhon wrote: post #34
zizek23 wrote: post #17

The casual culture of pulling in hundred of dependencies, and mushrooming language specific package managers is ridiculously insecure and has to go. There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable. If some developers like this sort of unsafe practice it should be strictly limited to their machines and in no way make it across in any form a…

Everything we do in life relies on a trust system more or less. Reproducible build only guarantees integrity, not the trustworthiness of the code. > There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable. Because few people have time to read source code. Take Django as an example. Big community, lots of contributors. Can we say we should trust th…

These problems you bring up are a different order to the "grab stuff from wherever" culture that seems to have sprung up around a lot of languages lately.

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#82

Post by thehardsphere »

chii wrote: post #74
coldtea wrote: post #56

Earlier quoted context omitted.

> You mean that every time you write a new project you write your own request parser, your own server, your own web framework, your own database access libraries, etc. from scratch? No, they mean that we need a better method than trusting some random popular GitHub / PyPy / npm whatever storage and delivery mechanism. Strong core language libraries ("batteries included"), that come with your distribution of the langu…

Java ecosystem has just as many libraries, and yet you don't see this problem. Why is that? Maven Central is just as available to add to (last i checked, all you need is a public GPG key registered to the MIT public gpg server).

It's not just as available to add to; you can only add to Central through one of three approved hosts unless your project has a special exception. And those hosts all involve an actual review of your artifact, its signature, and your POM.

I've never done it, but it at least sounds like there's a process where you need to convince 3 or more people that adding your package is a good idea and will not hurt security. That's very different from PyPI or npm.

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#83

Post by thehardsphere »

gjtorikian wrote: post #65
zizek23 wrote: post #17

The casual culture of pulling in hundred of dependencies, and mushrooming language specific package managers is ridiculously insecure and has to go. There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable. If some developers like this sort of unsafe practice it should be strictly limited to their machines and in no way make it across in any form a…

> Many have suffered and do not even bother with Ruby apps anymore. These sort of grandiose statements have of course existed on the Internet for decades, but with the rise of demagogues like Trump, we see that such statements can be readily believed en masse without a second thought. Could you provide data or numbers explaining that Ruby's package management system is a factor in new apps not being built in that lan…

I wasn't aware that anybody on Hacker News had an implicit moral obligation to "not harm the morale of new programmers", especially in cases where it might be a open question if said programmers are "wasting their time."

Also, there's a third choice if you have a better idea about how package managers could work: you can use an existing alternative that works better. If said existing alternative happens to be in some other language, and you don't have a strong reason to stay on your current language, then switching languages is perfectly sensible.

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#84

Post by omginternets »

grrowl wrote: post #28
reificator wrote: post #20

Earlier quoted context omitted.

NPM is my primary reason for not using NodeJS. I installed a specific package in an empty project and got over 690 dependencies. For running `npm install {package-name}`. What's worse is that I skimmed the tree to check for anything particularly heinous, but there was nothing that stood out as unneeded. With such a tiny stdlib, especially out of the browser environment, there's not really a better alternative than to…

You specifically chose a large dependency with many sub-dependencies, so yes, that will happen. There's also the risk of installing an outdated, unmaintained dependency. Do a little research — check the package's npm page, assess whether it's too light or too heavy for your use-case. Check its github page to assess whether it's currently maintained (and how important that is for your use-case). If you're unsure, look…

>You specifically chose a large dependency with many sub-dependencies, so yes, that will happen.

You're too kind.

JavaScript is outright unusable without pulling in hundreds of dependencies. NPM's ecosystem is 80% band-aids over terrible language design, which in turn leads to things like this: https://github.com/stevemao/left-pad/issues/4

NPM is the symptom. JS is the problem.

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#85

Post by throwme211345 »

zizek23 wrote: post #17

The casual culture of pulling in hundred of dependencies, and mushrooming language specific package managers is ridiculously insecure and has to go. There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable. If some developers like this sort of unsafe practice it should be strictly limited to their machines and in no way make it across in any form a…

I agree. This type of casual 'language manager install X', or even worse; use this container or vagrant image as your base, is the root of all evil. It is the political core of the devops revolution which allows developers to pollute operations with shortcuts and balloon code to avoid the hard work of maintaining/documenting a system and performing due diligence.

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#86

Post by ceejayoz »

reificator wrote: post #20
zizek23 wrote: post #17

The casual culture of pulling in hundred of dependencies, and mushrooming language specific package managers is ridiculously insecure and has to go. There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable. If some developers like this sort of unsafe practice it should be strictly limited to their machines and in no way make it across in any form a…

NPM is my primary reason for not using NodeJS. I installed a specific package in an empty project and got over 690 dependencies. For running `npm install {package-name}`. What's worse is that I skimmed the tree to check for anything particularly heinous, but there was nothing that stood out as unneeded. With such a tiny stdlib, especially out of the browser environment, there's not really a better alternative than to…

My favorite NPM moment was the time I realized a project's dependencies included all three of https://www.npmjs.com/package/array-unique, https://www.npmjs.com/package/array-uniq, and https://www.npmjs.com/package/uniq.

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#87

Post by Babooster »

ubernostrum wrote: post #67
seanp2k2 wrote: post #54

Earlier quoted context omitted.

The culture around what should be in a package is vastly different. Node has left-pad. Debian has stuff like Apache. Sure, those are radical examples, but the barrier to entry for Debian is pretty high (as is the standard for quality) vs npm where anyone can put whatever out there. How do things like left-pad even come to be widespread dependencies? Does the node development process involve a lot of "gee I wonder if…

JavaScript has things like left-pad because it doesn't have a standard library of modules for common tasks like other languages do, and because some of its built-in types don't have the same rich set of operations as other languages.

http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how...

is a nice article on the subject of left-pad. If you can't implement a left-pad in less than 5 minutes yourself, you don't know how to code.

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#88

Post by Ajedi32 »

chii wrote: post #68
namelost wrote: post #64

Earlier quoted context omitted.

Who says? npm is proof that package managers need to do none of these things to be successful, and indeed the traditional design of a package manager as a constraint solver is self-defeating, because it puts a perverse pressure on libraries to have as few dependencies as possible and to avoid using the package manager to resolve their dependencies . The reason npm has teething problems is because it's one of the firs…

How does npm solve the transitive dependencies problem?

If by "transitive dependencies problem" you mean a case where package A depends on package B which depends on package C and you want to use A in your project, then it solves that by simply pulling in all three of those packages.

Or did you mean the case where you want package D as well, and it depends on a conflicting version of package C? In that case, it solves the problem by pulling in both versions of package C and running both side by side.

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#89

Post by [deleted] »

rlpb wrote: post #44
yeukhon wrote: post #34

Earlier quoted context omitted.

Everything we do in life relies on a trust system more or less. Reproducible build only guarantees integrity, not the trustworthiness of the code. > There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable. Because few people have time to read source code. Take Django as an example. Big community, lots of contributors. Can we say we should trust th…

Distributions - let's take Debian as a concrete example - provide an audit trail to individual identified developers as a mitigation for users relying on trust. Just because we must necessarily rely on some level of trust does not mean that we must blindly trust, which is what happens when anyone can upload to a repository such as PyPI.

[deleted]

Re: Devs unknowingly use “malicious” modules snuck into official Python repository

#90

Post by Ajedi32 »

Babooster wrote: post #87
ubernostrum wrote: post #67

Earlier quoted context omitted.

JavaScript has things like left-pad because it doesn't have a standard library of modules for common tasks like other languages do, and because some of its built-in types don't have the same rich set of operations as other languages.

http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how... is a nice article on the subject of left-pad. If you can't implement a left-pad in less than 5 minutes yourself, you don't know how to code.

Just because you _can_ spend 5 minutes re-inventing the wheel in every project you write, doesn't mean you _should_.
Post reply on HN