4 ms·

How do you, as website owner, protect your users from something like this? https://www.bleepingcomputer.com/news/security/451-pypi-packages-install-chrome-exte

How do you, as website owner, protect your users from something like this? https://www.bleepingcomputer.com/news/security/451-pypi-packages-install-chrome-extensions-to-steal-crypto/ https://www.bleepingcomputer.com/news/security/451-pypi-pack...

dotancohen 3y ago
Why do you, as a website owner, think that it is your responsibility to protect your users from mistyping the name of Python packages they are installing via pip?
Asooka 3y ago
You do not, the user is responsible for the operation of their device. Most of the time this should be caught by whatever malicious software detector the user runs. Also, Chrome and Firefox very heavily guard against extensions being installed from outside of the usual way, i.e. by outside programs.
- flangola7 3y ago
  > You do not, the user is responsible for the operation of their device. As time goes on hand-waving the matter as "user's responsibility" is becoming a less and less acceptable answer. Hard assurances are being demanded and applied technologies are progressively patching the existing loopholes.
  - deleted 3y ago
    [deleted]
  - yjftsjthsd-h 3y ago
    It's not hand-waving; it literally is not the website's responsibility.
    - flangola7 3y ago
      Organization executives and lawmakers are increasingly demanding that digital services be made un-hackable. Someone with an attitude and trying to shirk duty by claiming we just have to trust that all of the users will always be responsible and non-abusive all of the time, will at best be laughed and shooed out of the room. More realistically be given a final PIP. Telling your bosses "no I'm not going to do that" is a resume generating event.
      - rixthefox 3y ago
        Both groups of people who have no direct understanding of how any of this works. You can demand change all you want but it doesn't change how the real world works. These people need to come off their high horse and come join the rest of us. So sick and tired of C-level people demanding shit they know nothing about.
kevincox 3y ago
At some point you don't. The cure becomes worse than the disease. Maybe if you could give users the option to enable it. But let's be honest, if this ships every bank will require it. Good luck checking your balance on Linux or a rooted Android phone. You will get an approved operating system to keep your cash under your bed.

dotancohen 3y ago

Why do you, as a website owner, think that it is your responsibility to protect your users from mistyping the name of Python packages they are installing via pip?

Asooka 3y ago

You do not, the user is responsible for the operation of their device. Most of the time this should be caught by whatever malicious software detector the user runs. Also, Chrome and Firefox very heavily guard against extensions being installed from outside of the usual way, i.e. by outside programs.

flangola7 3y ago
> You do not, the user is responsible for the operation of their device. As time goes on hand-waving the matter as "user's responsibility" is becoming a less and less acceptable answer. Hard assurances are being demanded and applied technologies are progressively patching the existing loopholes.
- deleted 3y ago
  [deleted]
- yjftsjthsd-h 3y ago
  It's not hand-waving; it literally is not the website's responsibility.
  - flangola7 3y ago
    Organization executives and lawmakers are increasingly demanding that digital services be made un-hackable. Someone with an attitude and trying to shirk duty by claiming we just have to trust that all of the users will always be responsible and non-abusive all of the time, will at best be laughed and shooed out of the room. More realistically be given a final PIP. Telling your bosses "no I'm not going to do that" is a resume generating event.
    - rixthefox 3y ago
      Both groups of people who have no direct understanding of how any of this works. You can demand change all you want but it doesn't change how the real world works. These people need to come off their high horse and come join the rest of us. So sick and tired of C-level people demanding shit they know nothing about.

kevincox 3y ago

At some point you don't. The cure becomes worse than the disease. Maybe if you could give users the option to enable it. But let's be honest, if this ships every bank will require it. Good luck checking your balance on Linux or a rooted Android phone. You will get an approved operating system to keep your cash under your bed.