Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

edera.dev

Post reply on HN
Print view View original

31–40 of 59 posts

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#31

Post by BobbyTables2 »

hsbauauvhabzb wrote: post #13
TealBLAHAJ wrote: post #3

The scary part isn’t the bug — it’s how fragile the patching process becomes once a crate goes unmaintained.

Package management systems are scary before packages are abandoned too. Your production infrastructure is trusting some random developer/s to both do the right thing and not get hacked. That’s not to say oss cannot be trusted, but it certainly makes trusting smaller projects and packages scary.

I really hate it when various packages expect users to add their custom repo. Especially for something where I don’t care about updates.

Feels like every little thing should be in its own docker container with limited filesystem access. Of course that is a whole lot of trouble…

The dependency trees in cargo/pip also greatly bother me.

VS Code extensions are also under appreciated. Some turd makes a “starter pack” for rust/python/etc with a great set of common extensions… plus a few that nobody has heard of… Over time, they reach 50k-100k downloads and start to appear legit… Excellent way to exfiltrate trade secrets!!!

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#33

Post by woodruffw »

lvass wrote: post #32

Why didn't crates.io maintainers apply the patch themselves? NPM does meddle with packages when an incident happens like they did with left-pad.

I think that would be pretty disruptive, and would break some assumptions around crate integrity that are deeply held.

My understanding is that the left-pad incident is not directly analogous, since it involved restoring a deleted package rather than modifying an extant package.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#34

Post by ajross »

cozzyd wrote: post #16
hsbauauvhabzb wrote: post #13

Earlier quoted context omitted.

Package management systems are scary before packages are abandoned too. Your production infrastructure is trusting some random developer/s to both do the right thing and not get hacked. That’s not to say oss cannot be trusted, but it certainly makes trusting smaller projects and packages scary.

In principle "traditional" curated Linux distro package systems will patch stuff even if upstream is unresponsive.

In practice, not principle. Virtually every non-trivial upstream package in debian/fedora/arch/whatever has at least a handful of distro-specific patches. Sometimes they're just configuration, sometimes they're distro-maintained security fixes, etc...

But people exercise those features regularly and distros are not shy about maintaining software. It's a very different world from "We Just Ship What They Give Us" in npm/cargo/etc...

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#35

Post by ajross »

greatgib wrote: post #24

I'm so confused, I was thinking that we were rewriting everything from C to Rust because Rust was a "safe language" preventing vulnerabilities...

This doesn't appear to be a memory safety bug. It's a data handling error, and the "RCE" in question is that the tar code can be fooled by a malicious tarball into writing files with arbitrary permissions at arbitrary paths (which is... actually something all tarballs can do, so I'm not really following why this is being treated as severe).

But to your point: yes, it's a good example about how security bugs live at all layers of the stack and that being checked against memory corruption does nothing to prevent you from writing bugs in the semantic space.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#36

Post by kobebrookskC3 »

greatgib wrote: post #24

I'm so confused, I was thinking that we were rewriting everything from C to Rust because Rust was a "safe language" preventing vulnerabilities...

if it was in c, who knows how many memory corruption bugs would be found before they stumbled upon this...

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#37

Post by SoftTalker »

ajross wrote: post #35
greatgib wrote: post #24

I'm so confused, I was thinking that we were rewriting everything from C to Rust because Rust was a "safe language" preventing vulnerabilities...

This doesn't appear to be a memory safety bug. It's a data handling error, and the "RCE" in question is that the tar code can be fooled by a malicious tarball into writing files with arbitrary permissions at arbitrary paths (which is... actually something all tarballs can do, so I'm not really following why this is being treated as severe). But to your point: yes, it's a good example about how security bugs live at a…

iow it's a bug that can corrupt your data, but it does it safely.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#38

Post by eviks »

lvass wrote: post #32

Why didn't crates.io maintainers apply the patch themselves? NPM does meddle with packages when an incident happens like they did with left-pad.

Do you have a more relevant example of meddling besides a binary block/publish?

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#39

Post by mook »

hsbauauvhabzb wrote: post #13
TealBLAHAJ wrote: post #3

The scary part isn’t the bug — it’s how fragile the patching process becomes once a crate goes unmaintained.

Package management systems are scary before packages are abandoned too. Your production infrastructure is trusting some random developer/s to both do the right thing and not get hacked. That’s not to say oss cannot be trusted, but it certainly makes trusting smaller projects and packages scary.

There's plenty of open source things from Google and Microsoft that's been abandoned too; so you'd need to evaluate the project independently of the sponsor.

This doesn't apply to close source things because you wouldn't be able to use it in the first place.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#40

Post by denhamparry »

zahlman wrote: post #20
denhamparry wrote: post #2

I'm from Edera. If you have any questions please send them our way

Since this came up specifically for `uv` (i.e. since the Python ecosystem relies on source distributions packaged as .tar.gz): has the Python standard library implementation (which is used by pip) been checked for a similar vulnerability?

It is unlikely to have the bug as it sees more use, but it is worth checking. There have been previous CVEs with Pythons tar module.
Post reply on HN