5 ms·

Yeah a time/activity based trust system like thepiratebay uses could be helpful. Also devs should get into the habit of providing sha256 hashes on offical chan

Yeah a time/activity based trust system like thepiratebay uses could be helpful. Also devs should get into the habit of providing sha256 hashes on offical channels (i.e., github readme) so users can validate (if its possible to validate a pkg before executing malicious code in the python ecosystem, I'm not sure how that'd work).

yjftsjthsd-h 4y ago
> Also devs should get into the habit of providing sha256 hashes on offical channels (i.e., github readme) so users can validate (if its possible to validate a pkg before executing malicious code in the python ecosystem, I'm not sure how that'd work). I would think the easy solution is to publish a public signing key per-person or per-project, and then sign individual files with that. So, GPG.
louislang 4y ago
> Yeah a time/activity based trust system like thepiratebay uses could be helpful. This is an excellent idea. Authors are something we are digging into heavily as part of an ongoing effort to improve trust in the open source ecosystem.
kroolik 4y ago
Doesn't pip's hash checking mode solve this issue? Freeze your requirements with hashes. Pypi already provides hashes for sdists and wheels. See https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode https://pip.pypa.io/en/stable/topics/secure-installs/#hash-c... If we are talking typos or other human errors, guess we could only warn people that there are other package with similar name available. Can't predict what people have in mind when they make a typo.
- louislang 4y ago
  It definitely does help. We've seen malicious actors introduce "bad things" into legitimate packages [1]. So hashes help identify what you got, but doesn't necessarily prevent you from getting something you didn't intend. [1] https://www.cisa.gov/uscert/ncas/current-activity/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js https://www.cisa.gov/uscert/ncas/current-activity/2021/10/22...

yjftsjthsd-h 4y ago

> Also devs should get into the habit of providing sha256 hashes on offical channels (i.e., github readme) so users can validate (if its possible to validate a pkg before executing malicious code in the python ecosystem, I'm not sure how that'd work). I would think the easy solution is to publish a public signing key per-person or per-project, and then sign individual files with that. So, GPG.

louislang 4y ago

> Yeah a time/activity based trust system like thepiratebay uses could be helpful. This is an excellent idea. Authors are something we are digging into heavily as part of an ongoing effort to improve trust in the open source ecosystem.

kroolik 4y ago

Doesn't pip's hash checking mode solve this issue? Freeze your requirements with hashes. Pypi already provides hashes for sdists and wheels. See https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode https://pip.pypa.io/en/stable/topics/secure-installs/#hash-c... If we are talking typos or other human errors, guess we could only warn people that there are other package with similar name available. Can't predict what people have in mind when they make a typo.

louislang 4y ago
It definitely does help. We've seen malicious actors introduce "bad things" into legitimate packages [1]. So hashes help identify what you got, but doesn't necessarily prevent you from getting something you didn't intend. [1] https://www.cisa.gov/uscert/ncas/current-activity/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js https://www.cisa.gov/uscert/ncas/current-activity/2021/10/22...