5 ms·
We've gotten flack from package developers submitting new packages to Package Control [0] because all additions to the default channel are hand reviewed. Part o
by wbond 10y ago
We've gotten flack from package developers submitting new packages to Package Control [0] because all additions to the default channel are hand reviewed. Part of this process is to prevent accidentally close package names, to try and encourage collaboration and to encourage developers to actually explain what their package does and how to use it.
My hope is to be automating a large amount of the review in the next few months, however I think this is a good argument for never having it be fully automatic. Having a human sanity check submissions isn't a terrible idea if we can keep the workload down.
Certainly this doesn't prevent a malicious author from posting a legitimate package and then changing the contents to be malicious, but that can be somewhat solved by turning off automatic updates.
[0] https://packagecontrol.io https://packagecontrol.io
- SCdF 10y agoHey Will, Thanks for keeping Package Control high quality, I know it's highly appreciated :-)
- notduncansmith 10y agoAnother grateful Package Control user here.
- eudox 10y agoKeep fighting the good fight.
- deleted 10y ago[deleted]
- bcg1 10y agoSonatype has a manual review process as well before allowing new projects to deploy to Maven Central. [1][2] One step to mitigate things like this as well would be to have some sort of "crowd-sourcing" command in the package manager program... like "npm flag coffe-script" or something like that to alert repository maintainers of possible issues. [1]: http://central.sonatype.org/pages/ossrh-guide.html http://central.sonatype.org/pages/ossrh-guide.html [2]: http://central.sonatype.org/articles/2014/Feb/27/why-the-wait/ http://central.sonatype.org/articles/2014/Feb/27/why-the-wai...
- mercer 10y ago> Certainly this doesn't prevent a malicious author from posting a legitimate package and then changing the contents to be malicious, but that can be somewhat solved by turning off automatic updates. Perhaps you could make this safer by adding an automatic check for how much the package has changed since the last version? And at least warn the user when they want to update?
- cortesoft 10y agoI don't know how much checking for how much the package has change would help. You wouldn't need to change much to exploit - one line that downloads and executes code from somewhere would do it.
- hoodoof 10y agoPerhaps list all new packages to the community and require/request validation or flagging by the community, along with listing similar package names.
- yxhuvud 10y agoTyposquatting can be flagged automatically (for reviewal of a human later) using Levenshtein distance.
- patates 10y agoFor Postgres users, it is built-in: https://www.postgresql.org/docs/9.5/static/fuzzystrmatch.html https://www.postgresql.org/docs/9.5/static/fuzzystrmatch.htm...