3 ms·
Supply chain attacks only matter for libraries that can make their own network call, or libraries that directly touch unsanitized web input however?
by VHRanger 4y ago
Supply chain attacks only matter for libraries that can make their own network call, or libraries that directly touch unsanitized web input however?
- hamandcheese 4y agoHow does one restrict network access for a library?
- galangalalgol 4y agoThat was my thinking. In Austral that is a thing, but in c++ not so much. And if you are building the dependency from source, which is pretty common, the common build systems are all Turing complete themselves so they can take over your pipeline and do bad things.
- lanstin 4y agoRun your CI in an allow listed only network and only allow access to either your private, security scanned, mirror or else keep well trusted things. Even if a bitcoin miner gets into the stack it can’t send the results to the source so it is less dangerous.
- galangalalgol 4y agoBut it can insert itself in your pipeline so that anyone who depends on you is also infected. We have already seen CI worms for thevlack of a better term. One was briefly spreading in crates.io early last year as part of the "crate depression" thing.
- bawolff 4y agoSupply chain attacks matter anytime you need to trust the code being run. Which is usually always. Most libraries have network access, but even if they didn't, supply chain attacks could be relavent (but probably less generic)