3 ms·
I appreciate the proactive approach. Is your project the author of the packages identified by NBU? If so: (1) Why is the tracking pingback obfuscated? (2) Wh
by edraferi 9y ago
I appreciate the proactive approach.
Is your project the author of the packages identified by NBU? If so:
(1) Why is the tracking pingback obfuscated?
(2) Why does the code include a cheeky hello instead of a link to https://www.pytosquatting.org/ https://www.pytosquatting.org/ ?
(3) Why is there not a visible warning when installing one of these packages?
=================
edit:
Reading through the linked blog post [0], it appears these researchers used different code that DID provide visible warning and an cleartext pingback. It also collected command history and hardware information.
[0] http://incolumitas.com/2016/06/08/typosquatting-package-managers/ http://incolumitas.com/2016/06/08/typosquatting-package-mana...
- hannob 9y agoWe're not the authors of those packages. But we own many others. 1. We're not obfuscating pingbacks. 2./3. We're raising an exception with an explanation and a link. Just look at the code of one of our packages: https://pypi.python.org/pypi/codecs https://pypi.python.org/pypi/codecs The research in 2016 was done by someone else. The kinda crazy thing is: Some of the package names he used were made available again after that instead of being blocked... And now we own them.
- edraferi 9y agoMan. You're right - that's a mess.
- chupapuma 9y agoAnd just to be super clear, this is the code. Hard from scary or obfuscated: html = urllib_request.urlopen( "https://www.pytosquatting.org/pingback/pypi/{}/".format(package_name) ) raise Exception( "This is a bogus package that should not be installed\n\n" "Please read https://www.pytosquatting.org" )
- deleted 9y ago[deleted]
- sounds 9y ago"Hard from scary or obfuscated" Maybe you are typing on mobile? "Far from scary or obfuscated" reads more clearly.