Typosquatting programming language package managers • Hacker News Board

Re: Typosquatting programming language package managers

#131

Post by zanchey » Wed, Jun 08, 2016, 11:34 PM UTC

mirekrusin wrote: post #74

with npm there should be at least an option which prompts for Y/N/A when package has preinstall hook. but even this just tries to put the problem under carpet. you could still for example have requests package which just installs request package, works as expected, just sends request/response to your own server from time to time. ie. when there's http basic auth used only.

Solaris did (does?) this - "this package contains installation scripts which run as superuser" or words to that effect. Unfortunately I never found a owa to inspect the scripts directly so it wasn't all that helpful.

Re: Typosquatting programming language package managers

#132

Post by hinkley » Wed, Jun 08, 2016, 11:35 PM UTC

kbenson wrote: post #73

Klathmon wrote: post #63

Earlier quoted context omitted.

Or just refer to packages by 2 names. Maintainer/PackageName It solves so many problems, this included.

This is all half of a much larger problem, which is package identification. Perl 6 specced out[1] quite a bit of a future system to handle a lot of this, and I believe a lot of it is now implemented. A few things you need to consider: - Maintainership can change over time. - Multiple people may trade off releasing a package, but it's still the same package. - There may be multiple repos (consider you may want to run…

A different maintainer per major/minor version number is probably common enough of a requirement that it should absolutely be considered in the scheme.

For a while I bumped into projects that tried to follow the old Linux model of even/odd version numbers for telegraphing API stability. Long term support and backported security enhancements are another case where maybe the guys working on new functionality are exactly the wrong people to take responsibility.

Re: Typosquatting programming language package managers

#133

Post by nailer » Wed, Jun 08, 2016, 11:44 PM UTC

Mahn wrote: post #43

> In the thesis itself, several powerful methods to defend against typo squatting attacks are discussed. Therefore they are not included in this blog post. http://incolumitas.com/data/thesis.pdf section 5 "Practical implications". Just wanted to point out that in case you skipped it it's worth a read, some interesting proposals there that are worth discussing with package manager maintainers. I particularly like the…

You'd Bayesian that.

- The package name is something lot of people regularly attempt to install, but it doesn't exist (per above) - The package name is 1-2 chars off from the name of another package which has more than X downloads - The package is frequently installed then uninstalled in a short time

Re: Typosquatting programming language package managers

#134

Post by flashman » Wed, Jun 08, 2016, 11:54 PM UTC

billyhoffman wrote: post #111

placeybordeaux wrote: post #105

Earlier quoted context omitted.

The research got computers to execute code on them without authorization and extracted information from them. That is a crime under the CFAA in the USA. Not sure what it is in Germany/EU.

"Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'"

That's an interesting point. Is there any case law on negligence versus malice?

Re: Typosquatting programming language package managers

#135

Post by fredrb » Thu, Jun 09, 2016, 12:04 AM UTC

Klathmon wrote: post #63

blowski wrote: post #15

Earlier quoted context omitted.

Banks have a similar problem when people write cheques or set up standing orders. You have to put a name and the account number. I wonder if you could do something similar here - enter the name of the package and a code of some sort. I haven't thought this through in a lot of detail.

Or just refer to packages by 2 names. Maintainer/PackageName It solves so many problems, this included.

    jashkenas/coffeescript

could go easily be mislead by:

    jashkneas/coffescript

Re: Typosquatting programming language package managers

#136

Post by andrewstuart » Thu, Jun 09, 2016, 12:16 AM UTC

Ouch. This really hurts. So hard to protect against human error.

Re: Typosquatting programming language package managers

#137

Post by hoodoof » Thu, Jun 09, 2016, 12:32 AM UTC

wbond wrote: post #44

We've gotten flack from package developers submitting new packages to Package Control [0] because all additions to the default channel are hand reviewed. Part of this process is to prevent accidentally close package names, to try and encourage collaboration and to encourage developers to actually explain what their package does and how to use it. My hope is to be automating a large amount of the review in the next fe…

Perhaps list all new packages to the community and require/request validation or flagging by the community, along with listing similar package names.

Re: Typosquatting programming language package managers

#138

Post by cplease » Thu, Jun 09, 2016, 2:03 AM UTC

random28345 wrote: post #119

billyhoffman wrote: post #111

Earlier quoted context omitted.

"Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'"

> "Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'" The prosecuting attorney is going to tell a jury of twelve of your non-technical "peers" that it is hacking. Your client…

Yup. I'm surprised an advisor would sign off on this thesis.

Re: Typosquatting programming language package managers

#139

Post by utexaspunk » Thu, Jun 09, 2016, 3:17 AM UTC

sqeaky wrote: post #103

utexaspunk wrote: post #17

Earlier quoted context omitted.

True- levenshtein isn't the best algorithm for the purpose. Is there an algorithm that takes key proximity into account? Like, 'libm' and 'libc' are sufficiently different to preclude typos, but 'lib[n/j/k]' or 'lib[x/d/f/v]' are not?

Key proximity on which of the hundreds of keyboard layouts?

Good question... I'd imagine your standard QUERTY makes up a sizeable majority of programmers, but then I have no data to back that up... :)

Re: Typosquatting programming language package managers

#140

Post by kzrdude » Thu, Jun 09, 2016, 4:33 AM UTC

tatterdemalion wrote: post #65

airless_bar wrote: post #46

This only seems to be an issue for languages where packages reside in a global namespace, like Python, Rust etc. I think most languages these days are a bit smarter and avoid this beginner mistake (for various reasons).

This is obviously not true. If `serde` resided at `erickt/serde` (as the counterproposal for Rust would've had it), I could create `erict/serde` or `erick-t/serde` or any other variations of erickt's handle. The only way this is 'solved' is if some third party authority hands out top level names and refuses to register names that are similar to other names for some definition of similar. The number of levels between…

The name is just one part of the problem.

There's another solution (like debian does), auditing what the package itself does, so that you don't allow malicious code into the repository.