Malicious libraries can steal all your application secrets in Elixir
1–10 of 13 posts
Re: Malicious libraries can steal all your application secrets in Elixir
#2This is an important thing to be aware of, but this is not unique to Elixir, and the article title does not mention Elixir specifically although the example shown is in Elixir. If you are not careful about your dependency chain, attacks like this could happen in any language. When you pull code in and run it in your app, you are trusting it as if you wrote it yourself.
Re: Malicious libraries can steal all your application secrets in Elixir
#3This is an important thing to be aware of, but this is not unique to Elixir, and the article title does not mention Elixir specifically although the example shown is in Elixir. If you are not careful about your dependency chain, attacks like this could happen in any language. When you pull code in and run it in your app, you are trusting it as if you wrote it yourself.
Not quite every language. Giving libraries access to every capability by default is a language design decision, not a law of nature.
Re: Malicious libraries can steal all your application secrets in Elixir
#4in any language
The subject matter and title unfairly single-out Elixir.
Re: Malicious libraries can steal all your application secrets in Elixir
#5This is an important thing to be aware of, but this is not unique to Elixir, and the article title does not mention Elixir specifically although the example shown is in Elixir. If you are not careful about your dependency chain, attacks like this could happen in any language. When you pull code in and run it in your app, you are trusting it as if you wrote it yourself.
Not quite every language. Giving libraries access to every capability by default is a language design decision, not a law of nature.
Do you mind highlighting languages that have avoided making similar decisions?
Re: Malicious libraries can steal all your application secrets in Elixir
#6Earlier quoted context omitted.
Not quite every language. Giving libraries access to every capability by default is a language design decision, not a law of nature.
Do you mind highlighting languages that have avoided making similar decisions?
This isn't a language, but CHERI has hardware-enforced capabilities, so if your library was never given a pointer that (even transitively) has access to some secret, it's completely SOL as it's impossible to access any memory without the corresponding capability.
Re: Malicious libraries can steal all your application secrets in Elixir
#7Earlier quoted context omitted.
Not quite every language. Giving libraries access to every capability by default is a language design decision, not a law of nature.
Do you mind highlighting languages that have avoided making similar decisions?
Don't programs runnign in iOS and perhaps Android (and macOS) have to put up modal dialogs requesting the person running the program for access to things it could screw up?
Is that an example?
Re: Malicious libraries can steal all your application secrets in Elixir
#8Is there something about Elixir that makes this surprising? Otherwise, the insight that code that forms part of an application has access to the application state is not exactly very deep.
Re: Malicious libraries can steal all your application secrets in Elixir
#9Plug: I've been building Packj [1] to detect dummy, malicious, abandoned, typo-squatting, and other "risky" packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as num funcs/files, spawning of shell, use of SSH keys, network communication, use of decode+eval, mismatch of GitHub code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages.
Re: Malicious libraries can steal all your application secrets in Elixir
#10Earlier quoted context omitted.
Not quite every language. Giving libraries access to every capability by default is a language design decision, not a law of nature.
Do you mind highlighting languages that have avoided making similar decisions?
With deno you need to manually specify if you want to permit internet access:
deno run --allow-net=xyz.com,abc.com
If you run without a domain, it allows access to all. Seems like it should be more explicit by default, perhaps there is a config option.
Speaking of config options, I wonder if there is a config option to prohibit access to domains like pastebin.org no matter what. Seems like an arms race that an attacker could circumvent, but maybe they won't bother and will only attack my dumber friends.