3 ms·
Robustly verifying identity isn't enough, because a developer with an outstanding reputation could lose their credentials to a spearphishing attack, and the att
by not2b 5y ago
Robustly verifying identity isn't enough, because a developer with an outstanding reputation could lose their credentials to a spearphishing attack, and the attacker could then modify crates using stolen credentials.
- rectang 5y agoI agree that authentication is not sufficient on its own, but I argue that it's necessary as part of the solution. A source package should meet the following criteria: • Package contents match exactly the source tree at a PGP signed commit at a public repository URL. This must be verified before the package is made available through the package manager. Now, if I am whitelisting PGP keys, an attacker needs to steal creds to get something by me. Ideally you want multiple signatures by trusted keys prior to publication. Each additional signature makes it significantly less likely that a package is provided by a malicious attacker. EDIT: Hmm, how about package signing parties held over videochat? If we already know each other and you tell me that a particular package was created by you, I sign it.