4 ms·

I think HTTPS gets you pretty far. There are far more concerning attack vectors for those package ecosystems to me

by klysm 4y ago

loic-sharma 4y ago
Supply chain attacks are not uncommon. Package signing can protect against those: 1. Package source hacking. Say an attacker gets access to a package source's storage and inserts malware into popular packages. Now your project contains malware. Your package manager can detect tampering if the packages are signed. 2. Dependency confusion attacks. Say my project downloads packages from the public source as well as my company's private source. An attacker realizes my company has a private package named `private-foo` and uploads a malicious package with the same name to the public source. Now my projects contains malware as it occasionally downloads the malicious package instead of my company's private package. Your package manager can detect packages from an unexpected author if they are signed. I can provide more examples if you'd like. None of these are hypothetical, all of them have happened already.
- kayodelycaon 4y ago
  > Dependency confusion attacks Just want to point out that bundler solves this problem (and many others). It pins gem versions in Gemfile.lock and it supports explicit source locations (like git repositories) for downloading gems.
jacques_chester 4y ago
HTTPS only protects the transmission from repository to user. It doesn't protect the package in the repository.
- klysm 4y ago
  Yeah but what trust system are you going to use for that? I don’t see how anything at scale buys you too much
  - pabs3 4y ago
    The Linux distros use OpenPGP/X.509 keys stored on HSMs for their archive security, and a set of per-maintainer keys that are used to verify changes to the archive. RubyGems/Cargo/etc could use something like that.
woodruffw 4y ago
In this setting, HTTPS provides integrity (the authoritative party is the package index, which can serve you anything.) It can't provide authenticity, which is the root of most of the more interesting attack vectors in packaging.

I think HTTPS gets you pretty far. There are far more concerning attack vectors for those package ecosystems to me

by klysm 4y ago

I think HTTPS gets you pretty far. There are far more concerning attack vectors for those package ecosystems to me

Supply chain attacks are not uncommon. Package signing can protect against those: 1. Package source hacking. Say an attacker gets access to a package source's storage and inserts malware into popular packages. Now your project contains malware. Your package manager can detect tampering if the packages are signed. 2. Dependency confusion attacks. Say my project downloads packages from the public source as well as my company's private source. An attacker realizes my company has a private package named `private-foo` and uploads a malicious package with the same name to the public source. Now my projects contains malware as it occasionally downloads the malicious package instead of my company's private package. Your package manager can detect packages from an unexpected author if they are signed. I can provide more examples if you'd like. None of these are hypothetical, all of them have happened already.

kayodelycaon 4y ago
> Dependency confusion attacks Just want to point out that bundler solves this problem (and many others). It pins gem versions in Gemfile.lock and it supports explicit source locations (like git repositories) for downloading gems.

jacques_chester 4y ago

HTTPS only protects the transmission from repository to user. It doesn't protect the package in the repository.

klysm 4y ago
Yeah but what trust system are you going to use for that? I don’t see how anything at scale buys you too much
- pabs3 4y ago
  The Linux distros use OpenPGP/X.509 keys stored on HSMs for their archive security, and a set of per-maintainer keys that are used to verify changes to the archive. RubyGems/Cargo/etc could use something like that.

woodruffw 4y ago

In this setting, HTTPS provides integrity (the authoritative party is the package index, which can serve you anything.) It can't provide authenticity, which is the root of most of the more interesting attack vectors in packaging.