5 ms·

I think it will break any of the open source package managers that rely on GitHub's proprietary hosting and distribution. Cargo, etc.

kreco 4y ago
I did not know package managers relied on Github, this is the most unwise thing to do from a package manager perspective. Anyone could just change username/organization and break thousands/millions of build.
- chisquared 4y ago
  > Anyone could just change username/organization and break thousands/millions of build. GitHub redirects you to the new name in the event of a rename and you look up the old one.
  - JamesonNetworks 4y ago
    For now, hopefully
    - naikrovek 4y ago
      yeah. if GitHub is even real.
      - JamesonNetworks 4y ago
        Well, we know GitHub is real. But we should also remember that they can change their API at anytime and basing a package manager on their priorities is not the best situation for the long term success of that package manager, unless they are owned by Microsoft
  - adders 4y ago
    until someone claims the old name as a new org/repo
- crabbone 4y ago
  Hello and welcome to PEP-508! In Python, we don't say "we don't host packages on a proprietary platform", we say "we have absolutely no clue where they are hosted and nobody audits them anyways, and we don't enforce package signing, and we'll just build from source with no build isolation what so ever, unless you remember to specify an obscure command-line option when installing... and have a nice day!"
  - oynqr 4y ago
    The entire python package management situation can be summed up with "we have no clue".
  - deckard1 4y ago
    it's amazing how we never learn. Things that Perl and CPAN and Linux distros figured out decades ago are constant issues today. It wasn't that long ago that NPM didn't even have checksums. CPAN runs unit tests on install. I can't imagine how slow that would be with npm. Package signing is, well... I suppose that's another lesson from the '90s people will learn about soon enough. With a web of trust as broad as python or npm you'll just have everyone running around with signing keys and "trusting" any key they come across because none of it is built on personal relationships. When Archlinux asks me to confirm adding package keys, what am I going to do? Say no? I don't know these people, but I want my shit to work.
    - crabbone 4y ago
      When it comes to my personal laptop, I also, typically, blindly trust the keys coming from developers because I don't have time for that. Not so much if I have to deploy a system into environment that several orders of magnitude more expensive than my laptop... With systems like Python, I'd imagine that a solution to web of trust would be that some group of developers would organize a curated set of packages. So, for the cases where you need better security assurances, you'd use that. I mean, of course there's no guaranteed solution for the web of trust, but, in practical terms, something like that would be good enough for regulators. There's already stuff like NumFOCUS. They don't particularly focus on the technical side of things, or endorsing more secure practices, but, in principle, they could. Maybe there will also be others once we have been bitten more times by some security breaches.
- naikrovek 4y ago
  GitHub redirects when this happens. if you move/rename within GitHub, anyway. I don't know how long those redirects last but they probably last until the name is used again. so it's not quite as bad as you're imagining but still not great. fortunately GitHub is starting to require 2FA for very popular projects (starting with NPM) because of supply chain attacks like what you describe.
bin_bash 4y ago
no, this is GitHub packages, not GitHub repositories. Cargo doesn't use this. It doesn't use GitHub repositories either, they store the crates internally. EDIT: I was wrong, the crates index does use a GitHub repo
- ameliaquining 4y ago
  The crates.io index actually is a GitHub repository, so I think a GitHub outage that affected repositories (not just packages) could break Cargo. Only metadata is stored there, though, not the actual crates. I'm not 100% sure why it works like this; there seems to be a plan to change things soon so that Cargo running on users' machines doesn't talk directly to GitHub by default (https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-sparse-protocol.html https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-spar...), though the GitHub repo would still be the source of truth. crates.io also uses GitHub as an OAuth provider (and it's currently the only one offered), so if that broke then people wouldn't be able to publish crates, though downloading existing ones would presumably still work since you don't have to log in to do that.
- VWWHFSfQ 4y ago
  Cargo is hard-coded to use GitHub for the crates.io index [1] [1] https://github.com/rust-lang/cargo/blob/master/src/cargo/sources/registry/mod.rs#L190 https://github.com/rust-lang/cargo/blob/master/src/cargo/sou...
  - snacktaster 4y ago
    That's a big yikes...
    - inejge 4y ago
      That's being addressed with a new index protocol, specified a while ago[1], available for testing since the middle of the last year[2], and slated for release in a week's time[3]. [1] https://rust-lang.github.io/rfcs/2789-sparse-index.html https://rust-lang.github.io/rfcs/2789-sparse-index.html [2] https://blog.rust-lang.org/2022/06/22/sparse-registry-testing.html https://blog.rust-lang.org/2022/06/22/sparse-registry-testin... [3] https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-sparse-protocol.html https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-spar...

kreco 4y ago

I did not know package managers relied on Github, this is the most unwise thing to do from a package manager perspective. Anyone could just change username/organization and break thousands/millions of build.

chisquared 4y ago
> Anyone could just change username/organization and break thousands/millions of build. GitHub redirects you to the new name in the event of a rename and you look up the old one.
- JamesonNetworks 4y ago
  For now, hopefully
  - naikrovek 4y ago
    yeah. if GitHub is even real.
    - JamesonNetworks 4y ago
      Well, we know GitHub is real. But we should also remember that they can change their API at anytime and basing a package manager on their priorities is not the best situation for the long term success of that package manager, unless they are owned by Microsoft
- adders 4y ago
  until someone claims the old name as a new org/repo
crabbone 4y ago
Hello and welcome to PEP-508! In Python, we don't say "we don't host packages on a proprietary platform", we say "we have absolutely no clue where they are hosted and nobody audits them anyways, and we don't enforce package signing, and we'll just build from source with no build isolation what so ever, unless you remember to specify an obscure command-line option when installing... and have a nice day!"
- oynqr 4y ago
  The entire python package management situation can be summed up with "we have no clue".
- deckard1 4y ago
  it's amazing how we never learn. Things that Perl and CPAN and Linux distros figured out decades ago are constant issues today. It wasn't that long ago that NPM didn't even have checksums. CPAN runs unit tests on install. I can't imagine how slow that would be with npm. Package signing is, well... I suppose that's another lesson from the '90s people will learn about soon enough. With a web of trust as broad as python or npm you'll just have everyone running around with signing keys and "trusting" any key they come across because none of it is built on personal relationships. When Archlinux asks me to confirm adding package keys, what am I going to do? Say no? I don't know these people, but I want my shit to work.
  - crabbone 4y ago
    When it comes to my personal laptop, I also, typically, blindly trust the keys coming from developers because I don't have time for that. Not so much if I have to deploy a system into environment that several orders of magnitude more expensive than my laptop... With systems like Python, I'd imagine that a solution to web of trust would be that some group of developers would organize a curated set of packages. So, for the cases where you need better security assurances, you'd use that. I mean, of course there's no guaranteed solution for the web of trust, but, in practical terms, something like that would be good enough for regulators. There's already stuff like NumFOCUS. They don't particularly focus on the technical side of things, or endorsing more secure practices, but, in principle, they could. Maybe there will also be others once we have been bitten more times by some security breaches.
naikrovek 4y ago
GitHub redirects when this happens. if you move/rename within GitHub, anyway. I don't know how long those redirects last but they probably last until the name is used again. so it's not quite as bad as you're imagining but still not great. fortunately GitHub is starting to require 2FA for very popular projects (starting with NPM) because of supply chain attacks like what you describe.

bin_bash 4y ago

no, this is GitHub packages, not GitHub repositories. Cargo doesn't use this. It doesn't use GitHub repositories either, they store the crates internally. EDIT: I was wrong, the crates index does use a GitHub repo

ameliaquining 4y ago
The crates.io index actually is a GitHub repository, so I think a GitHub outage that affected repositories (not just packages) could break Cargo. Only metadata is stored there, though, not the actual crates. I'm not 100% sure why it works like this; there seems to be a plan to change things soon so that Cargo running on users' machines doesn't talk directly to GitHub by default (https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-sparse-protocol.html https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-spar...), though the GitHub repo would still be the source of truth. crates.io also uses GitHub as an OAuth provider (and it's currently the only one offered), so if that broke then people wouldn't be able to publish crates, though downloading existing ones would presumably still work since you don't have to log in to do that.
VWWHFSfQ 4y ago
Cargo is hard-coded to use GitHub for the crates.io index [1] [1] https://github.com/rust-lang/cargo/blob/master/src/cargo/sources/registry/mod.rs#L190 https://github.com/rust-lang/cargo/blob/master/src/cargo/sou...
- snacktaster 4y ago
  That's a big yikes...
  - inejge 4y ago
    That's being addressed with a new index protocol, specified a while ago[1], available for testing since the middle of the last year[2], and slated for release in a week's time[3]. [1] https://rust-lang.github.io/rfcs/2789-sparse-index.html https://rust-lang.github.io/rfcs/2789-sparse-index.html [2] https://blog.rust-lang.org/2022/06/22/sparse-registry-testing.html https://blog.rust-lang.org/2022/06/22/sparse-registry-testin... [3] https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-sparse-protocol.html https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-spar...