Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Rust crate Arrayref runs a build-time payload

safedep.io

Post reply on HN
Print view View original

101–110 of 529 posts

Re: Malicious Rust crate Arrayref runs a build-time payload

#101

Post by andsoitis »

ux266478 wrote: post #56
irishcoffee wrote: post #34

Earlier quoted context omitted.

[flagged]

Rust as a language is mostly alright in my opinion. The problems I have with it are similar to the problems I have with C++, and it makes up for them in other really compelling ways. Where it loses me is Cargo and everything surrounding it. I'm essentially forced into an extreme where I just never use anything in the Rust ecosystem, or I have to deal with insane dependency graphs that have the density and microstate…

> Rust as a language is mostly alright in my opinion.

> Where it loses me is Cargo and everything surrounding it.

High praise!

Re: Malicious Rust crate Arrayref runs a build-time payload

#102

Post by somat »

jakubadamw wrote: post #41

Cargo desperately needs sandboxing for build.rs scripts. It’s been attempted before, but didn’t go very far¹. ¹ https://rust-lang.github.io/goals/2024h2/sandboxed-build-scr...

I mean sure, but anything the build script could do, the build artifact could also do, That is to say, if you don't trust your source why do you trust the thing it compiles into?

Re: Malicious Rust crate Arrayref runs a build-time payload

#103

Post by insanitybit »

rvz wrote: post #18
tsimionescu wrote: post #12

> arrayref is a small crate of four macros. Why do so many languages fall into this horrible practice?

The languages that have a poor standard library support have this issue and other languages encourage you to import tons of libraries to fix the problem. This is why Javascript and Typescript suffer from this the most and has little to nothing to do with "popularity" and likely 9/10 of these npm packages import an external library. Golang on the other-hand is just as popular and has a stronger standard library which…

Total nonsense. Python has a massive stdlib and there are malicious packages.

Re: Malicious Rust crate Arrayref runs a build-time payload

#104

Post by weinzierl »

Panzerschrek wrote: post #72
weinzierl wrote: post #43

Earlier quoted context omitted.

Mozilla, Google and a couple of others are publishing their audits through cargo vet. There are also additional audits done by individuals you can use through cargo crev. Overall the number of audited crates is in the thousands and you will find audits for most of the popular crates. In the end it is your decision to use unaudited or refuse unaudited crates.

> In the end it is your decision to use unaudited or refuse unaudited crates. It should be the default behavior of the package manager to allow downloading only audited/trusted packages. Forcing end-users of the language to be responsible for audit of all dependencies is impractical.

If you want that you can always use vetted package repositories like Nexus. Many companies do.

Re: Malicious Rust crate Arrayref runs a build-time payload

#105

Post by swiftcoder »

mabini wrote: post #87
fnoef wrote: post #73

Oh, so it's not only "JavaScript bad and npm bad". Apparently, if your language uses third party dependency registry, you are prone to malicious code, regardless if it's Javascript or not. Use containers for development. And reduce the amount of third party deps you import into your projects. This is only going to get worse.

[flagged]

> Just wondering, whenever things go wrong with Rust - why do you all (Rust devs) point the finger at JavaScript?

I know it is almost a sport to point fingers at the "evil rust evangelists" on HN at this point, but a quick look at the fnoef's comment history would show you that they are not a rust person.

Your account, on the other hand, is a sock puppet created specifically to bitch about rust. Pot, meet kettle?

Re: Malicious Rust crate Arrayref runs a build-time payload

#106

Post by kibwen »

abbadadda wrote: post #68

Are there any plans to more seriously develop the standard library in Rust? Or is the plan to remain in this status quo where users of Rust import nonsense and the dependency tree explodes (or users are forced to invent their own wheel?). Are there any comparisons between the state of the stdlib in C++ vs. Rust? I’d think that would serve as an excellent jumping off point to start chipping away.

The idea that Rust has a small standard library is a weird meme. Rust has an enormous standard library. Look at any Rust release and you'll see dozens of new library APIs added, and consider that Rust has about nine releases a year, meaning that Rust adds over a hundred APIs per year, and has consistently for the past ten years. Rust frequently adds things that obviate popular crates, most recently the cfg_if crate was made redundant by the new cfg_select macro. And half of every dependency graph that people wrong their hands over are actually first-party external crates provided by either the Rust organization itself or by known contributors to the project. When people say that Rust has a small standard library, mostly they seem to just mean that it doesn't include a webserver.

Re: Malicious Rust crate Arrayref runs a build-time payload

#107

Post by Aeolos »

burnt-resistor wrote: post #91
jakubadamw wrote: post #41

Cargo desperately needs sandboxing for build.rs scripts. It’s been attempted before, but didn’t go very far¹. ¹ https://rust-lang.github.io/goals/2024h2/sandboxed-build-scr...

Never going to work. Crates must be audited for behavior before use.

cargo add + rust-analyzer instantly executes build.rs before you have a chance to audit the code.

Cargo, please PLEASE give me a way to disable third-party build.rs and whitelist the ones I need. And please loudly mark any update that adds a build.rs where there was none before.

Re: Malicious Rust crate Arrayref runs a build-time payload

#108

Post by rtfeldman »

tancop wrote: post #75

We need effect based languages now. It's the only way to guarantee policies like no network, no file access, no unsafe code or FFI for a library before it even compiles. If anyone from epic is reading this please give us a timeline for open sorucing the Verse compiler. In the mean time I think it's possible to hack Cargo and run all build scripts in a microVM. The blast radius will be limited to malicious code in the…

I think the only language that's used in production where malicious dependencies can't do arbitrary effects is https://roc-lang.org - but it's a pre-0.1.0 language and as such its production usage is extremely minimal for now.

Re: Malicious Rust crate Arrayref runs a build-time payload

#109

Post by quotemstr »

insanitybit wrote: post #97
quotemstr wrote: post #94

Earlier quoted context omitted.

MicroVM this, effects that --- can we discuss security without needing to invoke bay area buzzwords? The idea is "least privilege", and we desperately need it in computing. The precise technical mechanism we use to achieve it is less important than committing to the idea that a dependency doesn't run with full privilege of its host program and an install script doesn't run with full privilege of the programmer. The o…

The technical mechanism is exactly the issue to figure out, there's a reason why projects don't have this and it's because different implementations have different tradeoffs.

No, the reason people haven't been doing this -- and we've had technologies for ages -- is that it's a huge pain in the ass, a "tax", that it's hard to get developers inside a company to pay, much less participants in open source ecosystems.

Look at how snap, flatpak, etc. provoke people to just turn off security rather than deal with breakages.

A new language won't help because the problem is social, not technical.

FFS, you can't even get people to use filesystems via intermediate objects in today's languages. People think your language is broken if you don't have an ambient open(). You don't need a new language to enforce capability discipline. You need to whack people repeatedly with a cluebat until their laziness and brain damage abate.

Re: Malicious Rust crate Arrayref runs a build-time payload

#110

Post by patmorgan23 »

fnoef wrote: post #73

Oh, so it's not only "JavaScript bad and npm bad". Apparently, if your language uses third party dependency registry, you are prone to malicious code, regardless if it's Javascript or not. Use containers for development. And reduce the amount of third party deps you import into your projects. This is only going to get worse.

Pulling in lots of dependencies creates this kind of risk regardless of the ecosystem. That being said in the JS/NPM world you tend to have a LOT more dependencies (especially indirect ones) than other languages. I saw someone do a cursory analysis and JS/Node projects tend to have 5x the number rust or ruby projects.

This is really a cultural problem not a technical one.

Post reply on HN