Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

edera.dev

Post reply on HN
Print view View original

11–20 of 59 posts

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#11

Post by aDyslecticCrow »

arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

I personally suspect it's an effect of the over reliance of the package manager approach to software development that rust and a few other languages use, which itself is an unintended to consequence of a well designed library import system.

Languages where importing a library is hard, libraries tend to grow quite large. Large libraries have larger backing, more established development and security protocols. When OpenCV, TinyUSB, Numpy, nimBLE start to struggle, it's easier to notice and companies relying on them may step up to fork, maintain of fund its continued use.

Languages where importing and creating a library is easy, we see small atomic packages for small utility programs, over large libraries. This spreads the software supply-chain wider, into smaller teams of maintainers. If the same amount of code is fractured over 50 small libraries maintained by 1-3 people each, the likelihood of one or two becoming abandoned grows.

I've been a bit weary about the dependency and package manager approach more modern languages use. It trades convenience for some pretty scary supply-chain attacks.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#13

Post by hsbauauvhabzb »

TealBLAHAJ wrote: post #3

The scary part isn’t the bug — it’s how fragile the patching process becomes once a crate goes unmaintained.

Package management systems are scary before packages are abandoned too. Your production infrastructure is trusting some random developer/s to both do the right thing and not get hacked.

That’s not to say oss cannot be trusted, but it certainly makes trusting smaller projects and packages scary.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#14

Post by dathinab »

arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

(no specific order)

1. easy to create

2. easy to produce something with decent quality

3. rust is widely used by a lot of people, including juniors which don't know (yet) that it can be quite a pain to maintain a package and that it comes with some responsibility

4. so small hobby projects now can very easily become widely used dependencies as people looked at them and found them to have decent quality

5. currently "flat" package structure (i.e. no prefixes/grouping by org/project) there has been discussions for improving on it for a long time but it's not quite here yet. This matters as e.g. all "official" tokio packages are named tokio-* but thats also true for most 3rd party packages "specifically made for tokio". So `tokio-tar` is what you would expect the official "tokio" tar package to be named _if there where one_.

---

now the core problem of many unmaintained packages isn't that rust specific

it's just that rust is currently a common go to for young developers not yet burned by maintaining a package, it's supper easy to publish

on the other hand some of the previous "popular early carrier go to languages" had either not had a single "official" repo (Jave) or packaging was/is a quite a pain (python). Through you can find a lot of unmaintained packages in npm too, just it's so much easier to write clean decent looking code in rust that it's more likely that you use one in rust then in JS.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#16

Post by cozzyd »

hsbauauvhabzb wrote: post #13
TealBLAHAJ wrote: post #3

The scary part isn’t the bug — it’s how fragile the patching process becomes once a crate goes unmaintained.

Package management systems are scary before packages are abandoned too. Your production infrastructure is trusting some random developer/s to both do the right thing and not get hacked. That’s not to say oss cannot be trusted, but it certainly makes trusting smaller projects and packages scary.

In principle "traditional" curated Linux distro package systems will patch stuff even if upstream is unresponsive.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#17

Post by normie3000 »

aDyslecticCrow wrote: post #11
arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

I personally suspect it's an effect of the over reliance of the package manager approach to software development that rust and a few other languages use, which itself is an unintended to consequence of a well designed library import system. Languages where importing a library is hard, libraries tend to grow quite large. Large libraries have larger backing, more established development and security protocols. When Ope…

I haven't seen this perspective before but it's a very elegant explanation for why e.g. npm is so much scarier than maven.

I wonder if safety could be improved a little if private package management was easier than throwing things out in public.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#18

Post by woodruffw »

arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

I think the null hypothesis would be that they’re no more common in Rust, but that Rust’s low-friction packaging ecosystem makes them more apparent to you than they would be in C or C++.

(Think about the last time you checked whether the stack of GNU libraries on your Linux desktop were actively maintained. I don’t think anybody thinks about it too hard, because the ecosystem discourages thinking about it!)

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#19

Post by woodruffw »

I triaged this vulnerability from Astral's side, so I wanted to make a clarificatory point that's also present in the advisory[1]: parser differentials can be extremely bad, but the risk to the Python ecosystem in this particular case is moderated by the fact that tar is only used with source distributions, which already possess arbitrary code execution at resolution/install time by design.

In other words: this is an obfuscation vector within Python packaging, but it doesn't grant the attacker a novel privilege.

(This doesn't detract from the overall severity of the bug itself: there are plenty of ecosystems and contexts where this is a serious issue, and there's no easy way to assert that they aren't affected by the bug in this family of async-tar packages. Edera has done an excellent job of highlighting this, and I thank them for their disclosure!)

[1]: https://github.com/astral-sh/tokio-tar/security/advisories/G...

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#20

Post by zahlman »

denhamparry wrote: post #2

I'm from Edera. If you have any questions please send them our way

Since this came up specifically for `uv` (i.e. since the Python ecosystem relies on source distributions packaged as .tar.gz): has the Python standard library implementation (which is used by pip) been checked for a similar vulnerability?
Post reply on HN