3 ms·

You know allowing people to upload libraries with highly conflicting names to existing ones is almost reckless. There is a bunch of stuff PyPi could do short o

by tus88 7y ago

You know allowing people to upload libraries with highly conflicting names to existing ones is almost reckless. There is a bunch of stuff PyPi could do short of full curation that would make this much harder. A better solution is for languages to provide a kind of "module sandboxing" where modules need to declare the capabilities they need, and the runtime prevents them from accessing anything else. In this case, the module would have needed to request the ability to make an outgoing TCP/IP connection - and that request should raise red flags for a date parsing utility.

rob-olmos 7y ago
Sandboxing in the language runtime is an interesting idea. I wonder if that could be offloaded to the OS/kernel instead so that every language doesn't have to reinvent the wheel. Eventually then hardware could handle it to reduce overhead. Eg, declare parts of the compiled/interpreted code with specific privileges. Kind of like how memory regions can be NX.
JackRabbitSlim 7y ago
MyPy requests permission to write data to the hard drive. MyPy writes malicious payload to a file and then execs it. MyPy never wrote a damn thing to a socket, netcat did through a bash/ash shell. (Windows named pipes may be a little trickier to work with but can yield similar results) Sandboxing libraries specifically seems like a fools errand.
- tus88 7y ago
  Writing to HDD would be considered a suspicious permission for most modules. Like opening network socket or patching another module's namespace. I don't know exactly how it would work. Maybe modules that request these permissions get extra scrutiny, or users can specify "levels" that different modules can run at. If you specify MyPy to run at the least-priv level, it will fail to install/load if it requests greater capabilities. I can't really think of any other way around the problem. It is a problem for all other scripting languages, especially nodeJS.
jxramos 7y ago
I wonder if employing some string metric threshold would make sense. It would be interesting to measure the dispersion of names across pypi along some chosen metric. https://en.wikipedia.org/wiki/String_metric https://en.wikipedia.org/wiki/String_metric

by tus88 7y ago

rob-olmos 7y ago

Sandboxing in the language runtime is an interesting idea. I wonder if that could be offloaded to the OS/kernel instead so that every language doesn't have to reinvent the wheel. Eventually then hardware could handle it to reduce overhead. Eg, declare parts of the compiled/interpreted code with specific privileges. Kind of like how memory regions can be NX.

JackRabbitSlim 7y ago

MyPy requests permission to write data to the hard drive. MyPy writes malicious payload to a file and then execs it. MyPy never wrote a damn thing to a socket, netcat did through a bash/ash shell. (Windows named pipes may be a little trickier to work with but can yield similar results) Sandboxing libraries specifically seems like a fools errand.

tus88 7y ago
Writing to HDD would be considered a suspicious permission for most modules. Like opening network socket or patching another module's namespace. I don't know exactly how it would work. Maybe modules that request these permissions get extra scrutiny, or users can specify "levels" that different modules can run at. If you specify MyPy to run at the least-priv level, it will fail to install/load if it requests greater capabilities. I can't really think of any other way around the problem. It is a problem for all other scripting languages, especially nodeJS.

jxramos 7y ago

I wonder if employing some string metric threshold would make sense. It would be interesting to measure the dispersion of names across pypi along some chosen metric. https://en.wikipedia.org/wiki/String_metric https://en.wikipedia.org/wiki/String_metric