Two malicious Python libraries caught stealing SSH and GPG keys • Hacker News Board

Re: Two malicious Python libraries caught stealing SSH and GPG keys

#321

Post by cyphar » Fri, Dec 06, 2019, 10:37 PM UTC

feanaro wrote: post #320

cyphar wrote: post #283

Earlier quoted context omitted.

Docker has had it's fair share of breakouts because the default configuration doesn't use user namespaces (one of the most significant security isolation features in Linux) and runs as root. It's not indicative of how secure a properly set up container is -- I don't remember the last time there was an LXC or LXD breakout (which use user namespaces by default). Source: I've found a fair few Docker breakouts. I also ma…

Don't user namespaces have significant security issues themselves?

There have been security bugs involving allowing unprivileged user namespaces, but that doesn't matter at all in this case -- seccomp is used by effectively all container runtimes to block things like CLONE_NEWUSER inside containers.

Re: Two malicious Python libraries caught stealing SSH and GPG keys

#322

Post by more-coffee » Sat, Dec 07, 2019, 12:46 PM UTC

mikepurvis wrote: post #153

more-coffee wrote: post #136

Earlier quoted context omitted.

Depending on the platform, virtualenv defaults to creating a symlink to the Python executable. You can override it with --copies, but then you have a new problem: updating the interpreter in all virtualenvs when a new Python release comes out.

On Ubuntu 16.04, the default behaviour is definitely to copy it, and there are no tricks with hardlinks or anything else: $ virtualenv foo Running virtualenv with interpreter /usr/bin/python2 New python executable in /home/administrator/foo/bin/python2 Also creating executable in /home/administrator/foo/bin/python Installing setuptools, pkg_resources, pip, wheel...done. $ ls -la foo/bin total 3464 drwxrwxr-x 2 admini…

Sorry for slow response, I don't check back here often enough.

You're right about virtualenv. I don't realy use that anymore, the venv module added in 3.3 gets the job done. And that does default to symlinks for posix. https://github.com/python/cpython/blob/3.8/Lib/venv/__init__...

Re: Two malicious Python libraries caught stealing SSH and GPG keys

#323

Post by swiley » Sat, Dec 07, 2019, 11:17 PM UTC

johnday wrote: post #75

swiley wrote: post #62

Don’t install packages with large numbers of dependancies (for me, this is more than 2.) Don’t install packages you haven’t at least been to the website for and preferably couldn’t build yourself. Libraries and package managers help us work together, they’re not excuses for not thinking.

Placing the burden of responsibility for security on the end user is not the way to go about this - at least, not if you want people to actually use your product / language. Package managers do not only exist as a convenience. They should also provide guarantees about their packages, or at the very least some level of moderation.

You could make that argument about repositories not package managers (which are just software.)

Some do! (Main OS repos (not community ones) do.) But the reality is that this takes man hours, so repositories have been set up without those guarantees in the name of efficiency and expectation of responsibility.

I don’t think these are built because people “want users for their language” but because they were needed. This whole “you shouldn’t do that because it scares users away” thing tends to result in terrible software IMO.