3 ms·
"no packaging ecosystem does." This is a little bit too strong, since packaging doesn't require arbitrary code execution. For example, Go doesn't permit arbitr
by spenczar5 4y ago
"no packaging ecosystem does."
This is a little bit too strong, since packaging doesn't require arbitrary code execution. For example, Go doesn't permit arbitrary code execution during `go get`. Now - there have been bugs which permit code execution (like https://github.com/golang/go/issues/22125 https://github.com/golang/go/issues/22125) but they are treated as security vulnerabilities and bugs.
Of course, you're right about Python.
- woodruffw 4y agoWhat I meant by that is that no packaging ecosystem (to my knowledge) runs arbitrary uploaded code to find network activity. Some may do simpler, static analyses, but outright execution for dynamic analysis purposes isn't something I'm aware of any ecosystem doing. Python, Ruby, et al. are in an even worse position than that baseline, since they have both arbitrary code in the package itself and arbitrary code in the package's definition. But the problem is a universal one!
- spenczar5 4y agoAh, yep, you're right about that as far as I know too.