PyPI Blog: Project Quarantine
blog.pypi.org
PyPI Blog: Project Quarantine
1–10 of 62 posts
Re: PyPI Blog: Project Quarantine
#2Awesome work, kudos to the PyPI team. Will it be possible to receive notifications of projects quarantine as a member of the public?
Re: PyPI Blog: Project Quarantine
#3Awesome work, kudos to the PyPI team. Will it be possible to receive notifications of projects quarantine as a member of the public?
Your comment also has me dreaming about a Dependabot-esque utility that opens Github issues on repositories that have quarantined projects in their requirements.txt.
Quarantining would prevent anyone from building / installing new copies of the compromised software, so this utility would only help people who were a) monitoring the project, and b) had a local version installed pre-quarantine. That's a pretty narrow scope of users, so now that I type all this out, I'm realizing that the juice is likely not worth the squeeze.
Re: PyPI Blog: Project Quarantine
#4Awesome work, kudos to the PyPI team. Will it be possible to receive notifications of projects quarantine as a member of the public?
Your comment also has me dreaming about a Dependabot-esque utility that opens Github issues on repositories that have quarantined projects in their requirements.txt. Quarantining would prevent anyone from building / installing new copies of the compromised software, so this utility would only help people who were a) monitoring the project, and b) had a local version installed pre-quarantine. That's a pretty narrow sc…
One of my responsibilities is software supply chain security in a financial services org, so this signal would be valuable for vulnerability management of dependencies. I wouldn't call it "threat hunting" per se, but ground truth around threat actor patterns helps us build better defensive systems in this regard. Keeping the bad bits out is way easier than remediating once they've been ingested into systems.
> Your comment also has me dreaming about a Dependabot-esque utility that opens Github issues on repositories that have quarantined projects in their requirements.txt.
It's not a bad idea, let Github know! Their security team is very good from my interactions with them.
Re: PyPI Blog: Project Quarantine
#5Given how widespread PyPI usage is, I'm surprised they only have one full time security staff. I mean I guess it makes sense, usage doesn't always mean they get more donations/money, but damn.
Re: PyPI Blog: Project Quarantine
#6Given how widespread PyPI usage is, I'm surprised they only have one full time security staff. I mean I guess it makes sense, usage doesn't always mean they get more donations/money, but damn.
companies that actually care about security have a more secure solution and don't allow devs to use pypi
Re: PyPI Blog: Project Quarantine
#7Given how widespread PyPI usage is, I'm surprised they only have one full time security staff. I mean I guess it makes sense, usage doesn't always mean they get more donations/money, but damn.
companies that actually care about security have a more secure solution and don't allow devs to use pypi
You’d be surprised by the amount of companies handling critical infrastructure that are OK with using PyPI directly
Re: PyPI Blog: Project Quarantine
#8Earlier quoted context omitted.
companies that actually care about security have a more secure solution and don't allow devs to use pypi
You’d be surprised by the amount of companies handling critical infrastructure that are OK with using PyPI directly
He said companies that care, not companies that should care but do not.
Re: PyPI Blog: Project Quarantine
#9Earlier quoted context omitted.
Your comment also has me dreaming about a Dependabot-esque utility that opens Github issues on repositories that have quarantined projects in their requirements.txt. Quarantining would prevent anyone from building / installing new copies of the compromised software, so this utility would only help people who were a) monitoring the project, and b) had a local version installed pre-quarantine. That's a pretty narrow sc…
One of my responsibilities is software supply chain security in a financial services org, so this signal would be valuable for vulnerability management of dependencies. I wouldn't call it "threat hunting" per se, but ground truth around threat actor patterns helps us build better defensive systems in this regard. Keeping the bad bits out is way easier than remediating once they've been ingested into systems. > Your c…
That sounds quite daunting, Python and supply chain security are almost at odds with each other these days.
Lowkey surprised that any well-resourced org would use it given the outsized risk profile and poor performance.
Re: PyPI Blog: Project Quarantine
#10The still don't even have a way to avoid dependency confusion attacks when using private package repos (other than also registering every single private package name you use on pypi.org). Blows my mind.