3 ms·

I think about this every time I install something through pip or apt. As someone with no knowledge about the package infrastructure but experience from SEO (dom

I think about this every time I install something through pip or apt. As someone with no knowledge about the package infrastructure but experience from SEO (domains), it seems like a simple task to just register common typos and spread malicious code. I assume there's some kind of vetting?

upon_drumhead 4y ago
pip is a Wild West of anyone can register anything without oversight. default apt repos are vetted by Debian/ubuntu folks.
mh- 4y ago
I can't speak to common practices in the popular apt repos, but for PyPi (pip) - no. No vetting.
cesarb 4y ago
> I think about this every time I install something through pip or apt. [...] it seems like a simple task to just register common typos and spread malicious code. I assume there's some kind of vetting? For distribution repositories (apt and so on), yes there's some vetting. To start with, only a limited set of people (the distribution's developers) are allowed to upload packages to a distribution repository, and even then, there's often a second layer of vetting for new package names. For instance, on Debian (https://wiki.debian.org/Teams/FTPMaster https://wiki.debian.org/Teams/FTPMaster): "When a package is uploaded to the unstable or experimental suite, it falls into one of three categories. If it is a new version of an existing package and adds no new binary packages, it is moved into the package pool automatically. If one or more of the binary packages or the source package itself is not currently in the archive or if a package is moved between the components (main, contrib, non-free), it is NEW and must be examined by an FTP Team member (see NewQueue). [...]" That is, when a new binary package is added, either because it comes from a new source package, or because a source package was modified to add a new binary package, the FTP masters have to manually approve it, before it becomes available to be installed by apt. This is different from language repositories (pip and so on), in which anyone can register a developer account, and there's no manual vetting of new package names.

upon_drumhead 4y ago

pip is a Wild West of anyone can register anything without oversight. default apt repos are vetted by Debian/ubuntu folks.

mh- 4y ago

I can't speak to common practices in the popular apt repos, but for PyPi (pip) - no. No vetting.

cesarb 4y ago

> I think about this every time I install something through pip or apt. [...] it seems like a simple task to just register common typos and spread malicious code. I assume there's some kind of vetting? For distribution repositories (apt and so on), yes there's some vetting. To start with, only a limited set of people (the distribution's developers) are allowed to upload packages to a distribution repository, and even then, there's often a second layer of vetting for new package names. For instance, on Debian (https://wiki.debian.org/Teams/FTPMaster https://wiki.debian.org/Teams/FTPMaster): "When a package is uploaded to the unstable or experimental suite, it falls into one of three categories. If it is a new version of an existing package and adds no new binary packages, it is moved into the package pool automatically. If one or more of the binary packages or the source package itself is not currently in the archive or if a package is moved between the components (main, contrib, non-free), it is NEW and must be examined by an FTP Team member (see NewQueue). [...]" That is, when a new binary package is added, either because it comes from a new source package, or because a source package was modified to add a new binary package, the FTP masters have to manually approve it, before it becomes available to be installed by apt. This is different from language repositories (pip and so on), in which anyone can register a developer account, and there's no manual vetting of new package names.