PyPI halted new users and projects while it fended off supply-chain attack

Post by taeric » Thu, Mar 28, 2024, 10:58 PM UTC

dns_snek wrote: post #15

taeric wrote: post #13

Earlier quoted context omitted.

Most any deployment based setup will have a separation between the code that is executed on the developer's machine and the code that is run on a built application? Yes, it is common for developers to have some unit/build testing setup available so that they can run the code locally, but even that should be done by a system that makes sure anything actually running during the test is declared as part of the project w…

How does that add any danger? You're pulling in code because you want to use it. If the package is malicious and your package manager doesn't have post-install scripts, the malicious code is just going to run 5 seconds later when you import it and start working with it. In the case of NPM with post-install scripts disabled, you'll simply get pwned when you `npm start` rather than `npm install`.

Post by TZubiri » Thu, Mar 28, 2024, 11:03 PM UTC

seabrookmx wrote: post #7

cjk2 wrote: post #2

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"? I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

You're not the only one! This is why I strongly prefer languages with a comprehensive standard library. I trust my Python/golang/dotnet/whatever install, so the number of third party packages I need to pull in is much smaller and more easily audited.

Post by dboreham » Thu, Mar 28, 2024, 11:09 PM UTC

ryukoposting wrote: post #24

Dependencies are liabilities, and any package manager that includes something like build.rs, setup.py, etc is vulnerable to RCE. None of this is news, but it's unnerving that a vast section of our industry seems to either be totally unaware, or totally apathetic.

Post by qwertox » Thu, Mar 28, 2024, 11:12 PM UTC

mopsi wrote: post #16

cjk2 wrote: post #2

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"? I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

Looks absolutely insane to me too. Recently I had to deal with a NPM-based theme for a minor website. It downloaded 140 dependencies. Most of them were trivial like "string-width", which finds the visual width of a character (some Unicode characters may appear as double-width). The package consists of a rather simple 25-line function that tests a character against several if-s in a loop. A function that trivial does…

Post by dboreham » Thu, Mar 28, 2024, 11:20 PM UTC

mopsi wrote: post #16

cjk2 wrote: post #2

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"? I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

Looks absolutely insane to me too. Recently I had to deal with a NPM-based theme for a minor website. It downloaded 140 dependencies. Most of them were trivial like "string-width", which finds the visual width of a character (some Unicode characters may appear as double-width). The package consists of a rather simple 25-line function that tests a character against several if-s in a loop. A function that trivial does…