Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PyPI halted new users and projects while it fended off supply-chain attack

arstechnica.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: PyPI halted new users and projects while it fended off supply-chain attack

#31

Post by cjk2 »

tredre3 wrote: post #26
cjk2 wrote: post #2

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"? I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

The current system is crazy to me as well, I've come to refuse to use online dependencies in my projects. It's brittle and it's a security nightmare. If I need a library, I look for a self contained one and I vendor it into the project. In other words I bypass the package manager but I still appreciate the ability to browse the online catalogue. :)

This is how I used to do stuff when I was working on .Net classic years ago. Check the damn dlls into SVN which was all in-house.

Re: PyPI halted new users and projects while it fended off supply-chain attack

#32

Post by text0404 »

qwertox wrote: post #27
mopsi wrote: post #16

Earlier quoted context omitted.

Looks absolutely insane to me too. Recently I had to deal with a NPM-based theme for a minor website. It downloaded 140 dependencies. Most of them were trivial like "string-width", which finds the visual width of a character (some Unicode characters may appear as double-width). The package consists of a rather simple 25-line function that tests a character against several if-s in a loop. A function that trivial does…

https://www.npmjs.com/package/is-odd It's stuff like this which makes me hate npm and the modern Javascript ecosystem in general. You start a new project and pull in a bigger thing like Quasar and npm fetches hundreds of packages and the summary tells you that 5 of them have vulnerabilities in them before you even get started. What am I supposed to do with them? But regarding the string-width problem, im not sure if…

this is hardly restricted to the javascript ecosystem. it's a problem with any language where third-party libraries are readily available.

Re: PyPI halted new users and projects while it fended off supply-chain attack

#33

Post by cjk2 »

qwertox wrote: post #30
cjk2 wrote: post #2

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"? I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

Im horrified by the extensions I've got installed in VS Code. They are so good but one day one will go rouge and install malware on my machine.

Please don't get me started on VScode. That is basically a remote execution environment. Just adding an extension and opening a file has the cheek to ask if what is on your filesystem is trusted immediately after downloading several tens of megabytes of who knows what for language server and parser.

I was using it for LaTeX stuff and programming but I shelved it. I'm on a Mac so it's system provided vim for me and the Apple command line dev tools, mostly for git, llvm and make. It works and I don't need or use any extensions for it or pull anything else onto my computer.

Re: PyPI halted new users and projects while it fended off supply-chain attack

#34

Post by cqqxo4zV46cp »

cjk2 wrote: post #2

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"? I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

How could you think that you’re the only one? This has (thankfully) been a widely discussed attack vector for many years now, and even longer within the more switched-on circles.

Re: PyPI halted new users and projects while it fended off supply-chain attack

#35

Post by cqqxo4zV46cp »

JohnFen wrote: post #12
cjk2 wrote: post #2

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"? I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

You're not the only one. I have become hesitant to use applications developed in certain languages and ecosystems (like Python) because they encourage the prolific use of unvetted code not under the control of the developer, although there is no real safe space anymore. It's a cultural shift that has affected almost everything.

From your perspective, the application itself is untrusted un-vetted third-party code until you yourself have vetted it, no? The fact that you also have to vet dependencies is meaningless implementation detail. You’ve got a bucket of code, you want to run it on your machine, and you decide that you want to vet it first. How does a package boundary change that? You’re describing security theatre.

Re: PyPI halted new users and projects while it fended off supply-chain attack

#36

Post by cjk2 »

cqqxo4zV46cp wrote: post #34
cjk2 wrote: post #2

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"? I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

How could you think that you’re the only one? This has (thankfully) been a widely discussed attack vector for many years now, and even longer within the more switched-on circles.

I work in a bubble with people who are ignorant.

Re: PyPI halted new users and projects while it fended off supply-chain attack

#37

Post by g_p »

lmm wrote: post #17
Denvercoder9 wrote: post #11

Earlier quoted context omitted.

I'm not convinced of the additional danger in letting packages run code during installation. You install them because you want to use them, so the code they ship will get run anyway. Are there really common environments where the final product only gets run with less permissions than the package manager?

> Are there really common environments where the final product only gets run with less permissions than the package manager? Yes, only running the final product in a VM/container is pretty common.

And this is a very sensible precaution where developer environments have SSH keys and other privileged credentials available and exposed in predictable locations, ready for exfiltration over the unfiltered internet connection that developers insist on having available.

Hopefully the VM/container run environment is also in a network-isolated environment too, so it can only be accessed and invoked through the expected routes, and it can't make arbitrary network calls to external hosts that haven't been manually reviewed and approved.

Re: PyPI halted new users and projects while it fended off supply-chain attack

#38

Post by cqqxo4zV46cp »

throwaway458864 wrote: post #4

I think people should stop using PyPI altogether. It's full of abandoned garbage and malware because there's really no filter on who can upload what. I don't even use it to search for packages anymore. If Linux distro packaging worked the same way, Linux would be a hellscape of malware and weird random broken apps. I'd rather use old software than constantly worry about fat fingering a package name and ending up with…

What an absolute joke. What’s your alternative?

Re: PyPI halted new users and projects while it fended off supply-chain attack

#39

Post by cqqxo4zV46cp »

dboreham wrote: post #25
ryukoposting wrote: post #24

Dependencies are liabilities, and any package manager that includes something like build.rs, setup.py, etc is vulnerable to RCE. None of this is news, but it's unnerving that a vast section of our industry seems to either be totally unaware, or totally apathetic.

There's a sort of "layer 0" problem above this which is: requiring 1000 different libraries from 900 different publishers to make a hello world program is going to end in tears. The modern languages need to consolidate into a few stdlib type libraries. Once that's done the problem of assuring the supply chain becomes more tractable.

Python, one of the two languages mentioned in the parent comment, has if anything a standard library that is TOO extensive, as made evident by the ‘dead batteries’ stdlib removal effort.

Re: PyPI halted new users and projects while it fended off supply-chain attack

#40

Post by seabrookmx »

mooreds wrote: post #22
seabrookmx wrote: post #7

Earlier quoted context omitted.

You're not the only one! This is why I strongly prefer languages with a comprehensive standard library. I trust my Python/golang/dotnet/whatever install, so the number of third party packages I need to pull in is much smaller and more easily audited.

What is your audit schedule/process?

Well it starts with a culture of taking responsibility when adding a dependency. We want people to look at child dependencies and just think more critically about them before checking in code. This is mostly to prevent bloat but sometimes we catch unmaintained packages or accidentally pulling in a random form rather than the community supported variant, for example.

We also run SAST in our gitlab pipelines and include reviewing the output as part of the code review and release process so that we can catch CVE's that may not have been known if when we first installed a package.

Post reply on HN