Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source security at Astral

astral.sh

Post reply on HN
Print view View original

101–110 of 120 posts

Re: Open source security at Astral

#101

Post by lrvick »

woodruffw wrote: post #97
lrvick wrote: post #95

Earlier quoted context omitted.

You can call it dead, and yet, it is the only system signing internet infrastructure at scale right now because of Debian, Suse, Fedora, Arch, Gentoo, Ubuntu, Redhat, etc. It is very much alive for those use cases that need it most. If one of those keys was compromised or the people that hold them, most of the internet is backdoored. Except for things built on stagex, in which case you would have to compromise severa…

No, I call it dead because it's dead. The SKS network is dead, the strong set is moribund, and the remaining real users of PGP are instead slinging key bundles around by baking them into pre-trusted artifacts (like ISOs). But that's not a "web of trust," it's just bespoke centralized key distribution with a certification format that every single serious cryptographer agrees is terrible. (And this is before a more bru…

I am deeply aware of Moxies views on this, and we have talked about them at length, and he is wrong. Also SKS and GnuPG are not OpenPGP. GnuPG no longer conforms to modern OpenPGP standards and is the IE6 grade implementation that we should stop talking about and using and on that point at least moxie and I agree. I found a major CVE in gpg myself.

But regardless of tooling, it is about the keys and who holds them and who they endorse. It does not really matter how keys are distributed. It matters that keys signed other keys and that we have a way of downloading them and verifying that.

We cache a copy of all 5444 keys in the web of trust of stagex maintainers in our keys repo and you can draw a line from our keys to the keys that signed commits to the linux kernel today. These also sync and update from a dozen SKS keyservers that are still online for anyone that wants to build a key directory as we did.

Though SKS is being rapidly replaced with WKD where every domain hosts their own keys and they are automatically discovered.

Are you really going to say this has no trust or security value?

We should all just stop and let Github sign everything for us even though they don't full source bootstrap anything or sign commits or use deterministic builds?

What is the outcome you are actually arguing for here.

Re: Open source security at Astral

#102

Post by lrvick »

saghm wrote: post #44
lrvick wrote: post #28

The only binaries of uv in the world you can get that were full source bootstrapped from signed package commits to signed reviews to multi-signed deterministic artifacts are the ones from my teammates and I at stagex. All keys on geodistributed smartcards held by maintainers tied to a web of trust going back 25 years with over 5000 keys. https://stagex.tools/packages/core/uv/ Though thankful for clients that let indi…

> Why is it a bunch of mostly unpaid volunteer hackers are putting more effort into supply chain security than OpenAI. Didn't the acquisition only happen a few weeks ago? Wouldn't it be more alarming if OpenAI had gone in and forced them to change their build process? Unless you're claiming that the article is lying about this being a description of what they've already been doing for a while (which seems a bit outla…

I was just calling them by their new name, but yes clearly I am not the biggest fan of OpenAI and me invoking their name so soon betrays that. Sam altmans vision for handling the "proof of human" problem WoT solves is having everyone scan their eyes into magic orbs you can't audit at runtime and letting them sign stuff for us. Cool. I will take WoT over that every time.

Re: Open source security at Astral

#103

Post by woodruffw »

lrvick wrote: post #101
woodruffw wrote: post #97

Earlier quoted context omitted.

No, I call it dead because it's dead. The SKS network is dead, the strong set is moribund, and the remaining real users of PGP are instead slinging key bundles around by baking them into pre-trusted artifacts (like ISOs). But that's not a "web of trust," it's just bespoke centralized key distribution with a certification format that every single serious cryptographer agrees is terrible. (And this is before a more bru…

I am deeply aware of Moxies views on this, and we have talked about them at length, and he is wrong. Also SKS and GnuPG are not OpenPGP. GnuPG no longer conforms to modern OpenPGP standards and is the IE6 grade implementation that we should stop talking about and using and on that point at least moxie and I agree. I found a major CVE in gpg myself. But regardless of tooling, it is about the keys and who holds them an…

> It does not really matter how keys are distributed. It matters that keys signed other keys and that we have a way of downloading them and verifying that.

I think it matters if you want to call it a WoT. But also, I don't think any signatures originating from these keys are being verified usefully at any meaningful scale.

> Are you really going to say this has no trust or security value?

I think it has marginal security value, maybe net-negative if you balance it with the fact that cryptographers and cryptographic engineers have to waste time arguing against using PGP.

> What is the outcome you are actually arguing for here.

I like binary transparency. I also think identity-based signing is significantly more ergonomic, and has seen more adoption in the last 4 years than PGP has in the last 35. And I think this is actually a stunning indictment, because I'd say that identity-based signing schemes like Sigstore are still running behind my expectations.

Re: Open source security at Astral

#105

Post by lrvick »

woodruffw wrote: post #103
lrvick wrote: post #101

Earlier quoted context omitted.

I am deeply aware of Moxies views on this, and we have talked about them at length, and he is wrong. Also SKS and GnuPG are not OpenPGP. GnuPG no longer conforms to modern OpenPGP standards and is the IE6 grade implementation that we should stop talking about and using and on that point at least moxie and I agree. I found a major CVE in gpg myself. But regardless of tooling, it is about the keys and who holds them an…

> It does not really matter how keys are distributed. It matters that keys signed other keys and that we have a way of downloading them and verifying that. I think it matters if you want to call it a WoT. But also, I don't think any signatures originating from these keys are being verified usefully at any meaningful scale. > Are you really going to say this has no trust or security value? I think it has marginal secu…

> I think it matters if you want to call it a WoT. But also, I don't think any signatures originating from these keys are being verified usefully at any meaningful scale.

Web of trust is a web of mutually trusting keys, not a network of servers. That web can be verified on any computer as in the blog post by kron I linked earlier, and it is verified for every package install in our soon-to-be published sxctl tool we will be presenting at some conferences next month.

> I think it has marginal security value, maybe net-negative if you balance it with the fact that cryptographers and cryptographic engineers have to waste time arguing against using PGP.

So again, are you really saying all the maintainers of most services running the internet should stop using the only IETF standard built for human-identity-bound signing with keys held by those humans?

The alternative everyone seems to be suggesting with a straight face is login with github or google and let them sign for you with "keyless signing"? That is the only alternative that is gaining adoption, and it is a ridiculous downgrade. I consider it mostly security theater.

The whole point of humans holding their own signing keys locally is to be able to make it not matter if your centralized online accounts are taken over. Something that is usually easy to do because no one uses hardware 2FA or renews their personal email domains.

But, if they did use hardware 2FA, hey look they have a local signing key... why not just... sign the binaries with that hardware directly instead of using that to login and let someone else sign for you. And then if you are going to do that, you don't want to be impersonated, so why not publish those public keys, and have other maintainers sign them. And now we have re-invented the web of trust.

Re: Open source security at Astral

#106

Post by skrtskrt »

MidnightRider39 wrote: post #65
fsflover wrote: post #58

Earlier quoted context omitted.

The solution is to use AGPLv3.

I’m maybe daft but AGPLv3 doesnt prevent $Evilcorp from using it, they just need to share any modifications or forks they made?

In reality most $Evilcorp have policies against AGPLv3, which is why projects can make moneh selling a less-restricted enterprise license for the same code.

Re: Open source security at Astral

#107

Post by MidnightRider39 »

skrtskrt wrote: post #106
MidnightRider39 wrote: post #65

Earlier quoted context omitted.

I’m maybe daft but AGPLv3 doesnt prevent $Evilcorp from using it, they just need to share any modifications or forks they made?

In reality most $Evilcorp have policies against AGPLv3, which is why projects can make moneh selling a less-restricted enterprise license for the same code.

I often hear this but I don’t really understand it. Not saying you need to explain it to me but what is the issue with AGPLv3 that turns those corporations away?

To my non-lawyer eyes it looks like MIT or Apache2 but modifications need to be made public as well.

If you don’t make any modifications then it should be fine? Or do most $Evilcorp aim to make modifications? Or is AGPLv3 something like garlic against vampires (doesn’t make sense but seems to work)?

Re: Open source security at Astral

#108

Post by seabass-labrax »

sevg wrote: post #4

FYI it was actually William Woodruff (the article author) and his team at Trail of Bits that worked with PyPI to implement Trusted Publishing.

And here's the video for his talk about it at PackagingCon 2023: https://www.youtube.com/watch?v=Fa9cI2Rf2qc

Re: Open source security at Astral

#109

Post by MidnightRider39 »

trollbridge wrote: post #86
MidnightRider39 wrote: post #65

Earlier quoted context omitted.

I’m maybe daft but AGPLv3 doesnt prevent $Evilcorp from using it, they just need to share any modifications or forks they made?

And at this point, it appears running code through an LLM to translate it eliminates copyright (and thus the licence), so $Anycorp can use it. Our stuff is AGPL3 licenced and if this present trend continues we might just switch to MIT so at least the little guys can take advantage of it the way the big guys can.

I think the whitewashing of code through LLMs is still unproven if it actually works for a reasonably complex project and also it’s still kind of legal Wild West - I think no one knows for sure how it will work out.

Re: Open source security at Astral

#110

Post by skrtskrt »

MidnightRider39 wrote: post #107
skrtskrt wrote: post #106

Earlier quoted context omitted.

In reality most $Evilcorp have policies against AGPLv3, which is why projects can make moneh selling a less-restricted enterprise license for the same code.

I often hear this but I don’t really understand it. Not saying you need to explain it to me but what is the issue with AGPLv3 that turns those corporations away? To my non-lawyer eyes it looks like MIT or Apache2 but modifications need to be made public as well. If you don’t make any modifications then it should be fine? Or do most $Evilcorp aim to make modifications? Or is AGPLv3 something like garlic against vampir…

AGPLv3 includes that “distribution” includes essentially communicating with the service over the network, as opposed to the GPL concept of like, sending a shrink wrapped binary that someone downloads and runs themselves.

So basically they are worried that they have no way of avoiding one or more of their tens of thousands of engineers “distributing” it to customers by including it in some sort of publicly accessible service. AFAIK there’s no settled case regarding what level of network communication qualifies - like if I run a CRUD app on Postgres and Postgres was AGPL, am I distributing Postgres?

Now the second part is that you only have to give out your changes to the AGPL software to those that it was “distributed” to. Most people aren’t changing it! If anything they’re just running a control plane in front of it…

but it goes back to the corporate legal perspective of “better safe than sorry” - we can’t guarantee that one of our engineers, isn’t changing it in some way that would expose company internals, then triggering a condition where they have to distribute those private changes publicly.

Post reply on HN