https://pantsbuild.org/ logo
Join Slack
Powered by
This is not how I imagined seeing my name in shini...
# random
b
This is not how I imagined seeing my name in shining lights... https://blog.orsinium.dev/posts/py/pypi-squatting/
😁 1
g
At least you've been filtered out as a false positive in the final list 😄
b
I noticed that!
I'm also the 16th most profilific package publisher on PyPI 😂
😲 3
w
This is why I like the approach NodeJS has gone, with organizations prefixing their org id and then the package ID. Leads to org squatting, but I think that's a bit easier to deal with overall. Cargo, Pypi, and all of those non-namespaced package managers are getting more annoying day after day.
f
Honestly (and this is weird to say)... I think Maven got this right
e
Isn’t the missing ingredient confirming who made the package via signing? I guess there are ways of breaking that, too, without someone taking on the job of verifying authenticity of the builder.
f
Package signing prevents certain kinds of takeovers, but only in the sense of "I can verify that these packages were published by an entity with access to the same private key". Private key custody is one obvious thing it tells you little about, but even worse it does nothing at all to combat typosquatting or other forms of attacks that don't rely on contaminating an actual package
Maven does a great job of preventing this by requiring that you prove you own a domain before you can publish to the namespace corresponsding to that domain. E.g. you have to prove you own example.com if you want to publish artifacts namespaced to 
com.example
. There are other security problems with Maven, but they're mostly related to the fact that the Maven authors formed Sonatype to sell the things that make it more secure as Nexus Premium
But all this means that your ability to name squat Maven Central is limited by your ability to name-squat domain names
Nobody would mistakenly download 
ru.yandex.and
lol
🧌 1
e
yeah. One has to say I only trust this private key to publish this package to squash typosquatting. How does one discover a trusted packager in the first place? Even domains can be typosquatted.
f
Distro vendors use signed packages, but there's a chain-of-trust model there that is afforded by their more centralized management. I think language package ecosystem maintainers have different goals and don't want to maintain a vetted list of known trusted publishers
👍🏽 1
e
Maybe 
pip install requests
should only be done via a private invite.
f
Or just 
pip install org.python-requests:requests
would be perfect 🙂
I'm not saying we should all use Maven either. It's just one thing that Maven and the modern JVM ecosystem it built got right. And virtually all other language package ecosystems got wrong (IMO)
e
pip install org.python-reguests:reguests
Then you have to have TWO typos to get 0wn3d.
f
exactly
not impossible, but harder
e
pip install org.paid-someone-to-protect-me:requests
is also a model, but who would do that?
f
also you need a credit card to register a domain, and while there's no shortage of shady ways to own a domain, it's more paperwork
👍🏽 1
e
It is all about raising the bar.
f
But it's also too late probably. It's a big breaking change
3 Views
Open in Slack
PreviousNext
Powered by