3 ms·
Meanwhile, Rust beginners are told to use a highly popular crate called 'reqwest'...
by misterdata 4y ago
Meanwhile, Rust beginners are told to use a highly popular crate called 'reqwest'...
- rickstanley 4y agoSorry for my ignorance, but is this a problem?
- stevemk14ebr 4y agoit could be. With the legit package named with a misspelling on purpose, users may confuse the correct spelling 'request' for the real package. in that case the typosquatting attack would actually not be a typo at all! You can't identify this attack by just looking for correct spelling, which is OPs point
- valbaca 4y agoIt's just humorous that in some packaging ecosystems a typo opens you up for a vulnerability, where as in other packaging systems, the more official packages are intentionally given weird names. Squatting is a problem as old as [NSFW] white house dot com versus [official] whitehouse.gov from the 2000s
- deleted 4y ago[deleted]
- heywoodlh 4y agoHaha I had never heard of white house dot com, the screenshot[1] I got from the site is a blast. [1] https://urlscan.io/result/e816e673-edf2-4177-9d3f-ac9a71c82603/ https://urlscan.io/result/e816e673-edf2-4177-9d3f-ac9a71c826...