Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Go's Infrastructure

reverse.put.as

Post reply on HN
Print view View original

1–10 of 80 posts

Re: Abusing Go's Infrastructure

#3

Post by kyrra »

Googler, opinions are my own. I know nothing about this space.

I would hope the Go team collaborated with GCP and Drive, as hosting malicious files is something Google has to deal with all the time. This isn't much different from other endpoints Google already allows people to put random data on.

Re: Abusing Go's Infrastructure

#4

Post by 8organicbits »

I know pypi has some non-python projects as well. Python needs the ability to distribute wheels, which are compiled binaries, as the user may not be able to compile library code. Lots of that code is written in C, but Golang[1] is also possible. I can't find an example, but I believe I've seen this used for distributing applications (not libraries) as well. It's kinda cool to write some app in C, upload to pypi, and then ask users to install with `pip install`.

[1] https://github.com/popatam/gopy_build_wheel_example

Re: Abusing Go's Infrastructure

#6

Post by bee_rider »

8organicbits wrote: post #4

I know pypi has some non-python projects as well. Python needs the ability to distribute wheels, which are compiled binaries, as the user may not be able to compile library code. Lots of that code is written in C, but Golang[1] is also possible. I can't find an example, but I believe I've seen this used for distributing applications (not libraries) as well. It's kinda cool to write some app in C, upload to pypi, and…

Hypothetically if they did try to add some requirement to use Python, people could just comply maliciously by providing the most minimal stub of Python code, right? Linux, but ls is written in Python. So it is probably better just to not play games.

Re: Abusing Go's Infrastructure

#7

Post by rfoo »

8organicbits wrote: post #4

I know pypi has some non-python projects as well. Python needs the ability to distribute wheels, which are compiled binaries, as the user may not be able to compile library code. Lots of that code is written in C, but Golang[1] is also possible. I can't find an example, but I believe I've seen this used for distributing applications (not libraries) as well. It's kinda cool to write some app in C, upload to pypi, and…

pip install cmake

or even proprietary binaries, pip install nvidia-cudnn-cu12

Re: Abusing Go's Infrastructure

#8

Post by jerf »

yjftsjthsd-h wrote: post #5
arccy wrote: post #2

it's a known issue https://github.com/golang/go/issues/31866

That fix would help with accidents, but wouldn't someone intentionally hoping doing it just add a .mod and .go file to the root?

How do you "fix" that at all?

In the end, there is no definition of "a source control repository that is a Go module" that is robust to this sort of "attack"... although calling it an "attack" is kind of dubious, the reasons why this is a bad thing strike me as very strained and relatively weak. Mostly it hurts Google by hosting too much stuff, but, good luck bringing them down that way.

Re: Abusing Go's Infrastructure

#9

Post by verdverm »

CUE's module system is finally rolling out, MVS likes Go's, but built on OCI infra. If you are interested in dependency management systems, here are some links

- proposal: https://github.com/cue-lang/proposal/tree/main/designs/modul...

- custom registry: https://cuelang.org/docs/tutorial/working-with-a-custom-modu...

- road map: https://github.com/orgs/cue-lang/projects/10/views/8

- in 0.9.0-alpha-5, modules become enabled by default: https://github.com/cue-lang/cue/releases/tag/v0.9.0-alpha.5

For Go Sum, the Trillian project backs the transparency log: https://github.com/google/trillian

CUE plans to piggyback on the OCI options with attestations and such

Post reply on HN