3 ms·

Somewhat related question, do you think there is a market for vetted/audited/curated mirrors of the major language package registries such as PyPI and NPM? The

Somewhat related question, do you think there is a market for vetted/audited/curated mirrors of the major language package registries such as PyPI and NPM? These "uncurated" package managers will always be vulnerable to someone uploading compromised builds. Would people pay for a mirror of these that contain a curated list of vetted builds? It would probably only have a small subset of the origin registry. The vetting or auditing could be at a couple of different levels, automatic based on on "trusted" authors and signed packages, automatic code analysis, and higher level manual vatting. Customers could request packages that are on the open list be included in the curated and vetted version. Obviously there will be some time lag between packages being uploaded to the origin before they have been vetted and places on the curated mirror. Some sort of expedited process would be needed to security releases. /random thought for the day

heresie-dabord 4y ago
> do you think there is a market for vetted/audited/curated library repositories (Slightly fixed to make more general.) There is a need but there will not be a market until security is taken seriously by industry.^1 [1] ETA unknown.
woodruffw 4y ago
There is indeed a market for it; at least, Google thinks so: https://cloud.google.com/assured-open-source-software https://cloud.google.com/assured-open-source-software
- samwillis 4y ago
  As ever Google are unable to produce a homepage for an "enterprise" product that clearly describes what it does and how to use it.
pletnes 4y ago
Anaconda python and activestate python are products in this space, I’d argue.
donmcronald 4y ago
> do you think there is a market for vetted/audited/curated mirrors of the major language package registries I personally wouldn't see much value in it, but it wouldn't surprise me if there was a market for it since it would be a good way for large companies to claim they're being responsible without doing anything but spending a (relatively) small amount of money. The reason I don't think there's a lot of value in it is because having something curated or audited by anyone that isn't an expert in the niche isn't going to super effective, is it? Maybe they can pick out obviously malicious code and there are some easy wins at the start, but I think bad actors would adapt and do a better job of obfuscating malicious code.
nubinetwork 4y ago
I would love to see repo platform owners do something about new project repos, but that doesn't do anything when a developer ragequits and puts malicious code in their own repo that's been around for years. Really, there is no good option if you want the repo platform to be accessible to new projects.
ashishbijlani 4y ago
We’re building a private registry based on Packj [1] that hosts vetted artifacts. Will post more about it publicly soon. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj flags malicious/risky packages.

heresie-dabord 4y ago

> do you think there is a market for vetted/audited/curated library repositories (Slightly fixed to make more general.) There is a need but there will not be a market until security is taken seriously by industry.^1 [1] ETA unknown.

woodruffw 4y ago

There is indeed a market for it; at least, Google thinks so: https://cloud.google.com/assured-open-source-software https://cloud.google.com/assured-open-source-software

samwillis 4y ago
As ever Google are unable to produce a homepage for an "enterprise" product that clearly describes what it does and how to use it.

pletnes 4y ago

Anaconda python and activestate python are products in this space, I’d argue.

donmcronald 4y ago

> do you think there is a market for vetted/audited/curated mirrors of the major language package registries I personally wouldn't see much value in it, but it wouldn't surprise me if there was a market for it since it would be a good way for large companies to claim they're being responsible without doing anything but spending a (relatively) small amount of money. The reason I don't think there's a lot of value in it is because having something curated or audited by anyone that isn't an expert in the niche isn't going to super effective, is it? Maybe they can pick out obviously malicious code and there are some easy wins at the start, but I think bad actors would adapt and do a better job of obfuscating malicious code.

nubinetwork 4y ago

I would love to see repo platform owners do something about new project repos, but that doesn't do anything when a developer ragequits and puts malicious code in their own repo that's been around for years. Really, there is no good option if you want the repo platform to be accessible to new projects.

ashishbijlani 4y ago

We’re building a private registry based on Packj [1] that hosts vetted artifacts. Will post more about it publicly soon. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj flags malicious/risky packages.