141–148 of 148 posts
Earlier quoted context omitted.
Wrong.
Say that a popular package lives at `jack/foo`. An attacker needs only register `jakc` and create a package `foo`, and now anyone typing `blah install jakc/foo` is owned. There's a reason why "namespacing" isn't listed under the "Defenses against typo squatting" section.
We've gotten flack from package developers submitting new packages to Package Control [0] because all additions to the default channel are hand reviewed. Part of this process is to prevent accidentally close package names, to try and encourage collaboration and to encourage developers to actually explain what their package does and how to use it. My hope is to be automating a large amount of the review in the next fe…
We've gotten flack from package developers submitting new packages to Package Control [0] because all additions to the default channel are hand reviewed. Part of this process is to prevent accidentally close package names, to try and encourage collaboration and to encourage developers to actually explain what their package does and how to use it. My hope is to be automating a large amount of the review in the next fe…
Typosquatting can be flagged automatically (for reviewal of a human later) using Levenshtein distance.
Earlier quoted context omitted.
There was no actual intrusion, so this feels like fair game to me. Especially since mitigating a very possible attack vector is a direct result of running experiment. Still, hopefully the researchers got an IRB to sign off on the experiment setup...
The research got computers to execute code on them without authorization and extracted information from them. That is a crime under the CFAA in the USA. Not sure what it is in Germany/EU.
Earlier quoted context omitted.
Are you asking if the maintainer of 'requests' decides to spy on computers and phone home information? What packages do this?
Not a laywer, I'm just picking nits. It seems to me when you pip install a package, you are saying "download and run its setup.py file". What if requests did something you didn't like, something simple like write a new directory or change the name of a certain file. Could you sue over that? Where is the distinction?
I was thinking that a simple way this would be illegal in the US would be
"[accessing] a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer"
See a2C here: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#C...
I'd assume you can make a decent case that the person only authorized the installation of a piece of software, not the gathering of identifying information.
IP addresses can be used as identifying information especially when paired with a timestamp.
Being an American citizen living in the US I would not want my name on this paper.
Earlier quoted context omitted.
Not a laywer, I'm just picking nits. It seems to me when you pip install a package, you are saying "download and run its setup.py file". What if requests did something you didn't like, something simple like write a new directory or change the name of a certain file. Could you sue over that? Where is the distinction?
No one would be suing. This would be criminal. I was thinking that a simple way this would be illegal in the US would be "[accessing] a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer" See a2C here: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#C... I'd assume you can make a decent case that the person only authorized the installati…
Instead of blacklisting, why not respond with a "You requested package ABD, but we think you might mean package ABC. Enter 'yes' to continue or anything else to start over." That way authors can continue to use any name they want, and the emphasis is on letting installers know that they might be installing the wrong package.
"You requested package ABD, but we think you might mean package ABC. Enter 'yes' to continue or anything else to start over." That'll be fun to automate around in puppet or ansible.