3 ms·

Why would a user install a cargo-buidl package when cargo build already works? Typosquatting is definitely an issue, but not in this specific case.

• kzrdude 4y ago
  The binary can be named that without the package being named so, so it seems it could happen
  • dmytrish 4y ago
    If an intruder can rename files in your $PATH, the defense is already broken (e.g. they could do the same with any of .bashrc, .profile, anything in .local/bin and many, many other places). If a program can run seemingly innocent programs like less or sed, it already can run arbitrary commands. Security story of developing on Linux is basically non-existent unless you do everything on a remote machine or at least in a container (and, oh irony: direct access from your user to the Docker daemon basically means having root for that user).
    • deleted 4y ago
      [deleted]
    • kzrdude 4y ago
      Well I was thinking that "cargo install foo" can already install cargo-buidl in your path by innocent means i.e. no Rust build script. But with build scripts (build.rs) any crate indeed has arbitrary code execution at build time, so they can't be trusted, like you imply. However, sandboxing might be coming for build scripts, and when that's done, the typo attack is still there (package "foo" installing cargo-buidl).
• cozzyd 4y ago
  right, but cargo-buidl could be installed as part of a different package that also provides a more useful-sounding binary, no?