3 ms·

This is plain false. Most production-grade distribution do extensive vetting of the packages, both in terms of code and legal. Additionally, distribution packa

This is plain false. Most production-grade distribution do extensive vetting of the packages, both in terms of code and legal. Additionally, distribution packages are tested by a significant number of users before the release. Nothing of this sort happens around any language-specific package manager. You just get whatever happens to be around all software forges. Unsurprisingly, there has been many serious supply chain attacks in the last 5 years. None of which affected the usual big distros.

morelisp 4y ago
No, Go modules implement a global TOFU checksum database. Obviously a compromised upstream at initial pull would not be affected, but distros (other than the well-scoped commercial ones) don’t do anything close to security audits of every module they package either. Real-world untargeted SCAs come from compromised upstreams, not long-term bad faith actors. Go modules protects against that (as well as other forms of upstream incompetence that break immutable artifacts / deterministic builds). MVS also prevents unexpected upgrades just because someone deleted a lockfile.
morelisp 4y ago
> None of which affected the usual big distros. I guess we can argue about "big" but didn't both Arch (https://lists.archlinux.org/pipermail/aur-general/2018-July/034151.html https://lists.archlinux.org/pipermail/aur-general/2018-July/...) and Gentoo (https://wiki.gentoo.org/wiki/Project:Infrastructure/Incident_reports/2018-06-28_Github https://wiki.gentoo.org/wiki/Project:Infrastructure/Incident... and older, https://bugs.gentoo.org/show_bug.cgi?id=323691 https://bugs.gentoo.org/show_bug.cgi?id=323691) have actual compromised packages? And also not five years ago, but Fedora (https://lists.fedoraproject.org/pipermail/announce/2011-January/002911.html https://lists.fedoraproject.org/pipermail/announce/2011-Janu...) and Debian (https://www.debian.org/News/2003/20031202 https://www.debian.org/News/2003/20031202) had compromises but no known package changes.

morelisp 4y ago

No, Go modules implement a global TOFU checksum database. Obviously a compromised upstream at initial pull would not be affected, but distros (other than the well-scoped commercial ones) don’t do anything close to security audits of every module they package either. Real-world untargeted SCAs come from compromised upstreams, not long-term bad faith actors. Go modules protects against that (as well as other forms of upstream incompetence that break immutable artifacts / deterministic builds). MVS also prevents unexpected upgrades just because someone deleted a lockfile.

morelisp 4y ago

> None of which affected the usual big distros. I guess we can argue about "big" but didn't both Arch (https://lists.archlinux.org/pipermail/aur-general/2018-July/034151.html https://lists.archlinux.org/pipermail/aur-general/2018-July/...) and Gentoo (https://wiki.gentoo.org/wiki/Project:Infrastructure/Incident_reports/2018-06-28_Github https://wiki.gentoo.org/wiki/Project:Infrastructure/Incident... and older, https://bugs.gentoo.org/show_bug.cgi?id=323691 https://bugs.gentoo.org/show_bug.cgi?id=323691) have actual compromised packages? And also not five years ago, but Fedora (https://lists.fedoraproject.org/pipermail/announce/2011-January/002911.html https://lists.fedoraproject.org/pipermail/announce/2011-Janu...) and Debian (https://www.debian.org/News/2003/20031202 https://www.debian.org/News/2003/20031202) had compromises but no known package changes.