4 ms·

danger_accept_invalid_certs(true) // allow http as well I don't know what I expected from a github user named "pwnwriter".

deleted 3y ago
[deleted]
ragnarel 3y ago
In the "Why?" section he says that he is a CTF player. He should be very security-concernet, he shouldn't?
- 8organicbits 3y ago
  I've found that security skill in one area doesn't translate to others. Someone good at breaking things isn't necessarily good at building secure things.
PhilipRoman 3y ago
While I haven't looked at the code and can't tell you if it's the case here, most package managers I've used use unencrypted http for the traffic. Security is achieved by verifying the signature of the downloaded file. An additional benefit is that you can easily put a http proxy in front of it.
azathothas 3y ago
Hi, I am the package maintainer for https://github.com/metis-os/hysp-pkgs https://github.com/metis-os/hysp-pkgs (The default source that's shipped with hysp) To address your concerns: 1. Hysp allows making request to http-only sites, because hysp doesn't care where you host your binaries. As long as you have sha256sum/blake3sum of the binaries, and they match, hysp will work. 2. The default pkg source that ships with hysp, is hosted on github itself, where's there's no need to use http. HTTP is simply a fallback, and meant for maximum compatibility. 3. As installing random binaries from random sources is not advisable due to security concerns, the pkg-source can be self-hosted by anyone and hysp can be configured to use that instead of the default source.
- NewJazz 3y ago
  Good to know that checksums are being used... But are they signed at all? How do I get the checksum in the first place? Sorry don't mean to heckle, just was skimming through the code and saw that line.
  - azathothas 3y ago
    It's up to the pkg maintainer that's being used as the source. The default PKGs, located at: https://github.com/metis-os/hysp-pkgs https://github.com/metis-os/hysp-pkgs, are automated via GitHub actions. You can look at the workflow codes. As to answer the signing question: $BIN.TOML must contain either blake3sum or sha256sum of the binary specified as source. And once hysp downloads them, it checks if they match exactly as specified in the $BIN.TOML We prevent MITM or any other shenanigans by trusting whoever is hosting the pkg, isn't tampering both the binary and the checksums. So yes, not completely foolproof (an attacker could, in theory, tamper both the binary and the checksum), but that's why we have the self-hosting option for people who want to trust only themselves and their servers. The config allows you to specify different URL/Host for the TOML files and the actual binaries. So unless, both the TOML files and source binaries are being hosted on an HTTP site, MITM is not possible. And as already specified, the default source that ships with hysp, doesn't use HTTP anywhere.

deleted 3y ago

[deleted]

ragnarel 3y ago

In the "Why?" section he says that he is a CTF player. He should be very security-concernet, he shouldn't?

8organicbits 3y ago
I've found that security skill in one area doesn't translate to others. Someone good at breaking things isn't necessarily good at building secure things.

PhilipRoman 3y ago

While I haven't looked at the code and can't tell you if it's the case here, most package managers I've used use unencrypted http for the traffic. Security is achieved by verifying the signature of the downloaded file. An additional benefit is that you can easily put a http proxy in front of it.

azathothas 3y ago

Hi, I am the package maintainer for https://github.com/metis-os/hysp-pkgs https://github.com/metis-os/hysp-pkgs (The default source that's shipped with hysp) To address your concerns: 1. Hysp allows making request to http-only sites, because hysp doesn't care where you host your binaries. As long as you have sha256sum/blake3sum of the binaries, and they match, hysp will work. 2. The default pkg source that ships with hysp, is hosted on github itself, where's there's no need to use http. HTTP is simply a fallback, and meant for maximum compatibility. 3. As installing random binaries from random sources is not advisable due to security concerns, the pkg-source can be self-hosted by anyone and hysp can be configured to use that instead of the default source.

NewJazz 3y ago
Good to know that checksums are being used... But are they signed at all? How do I get the checksum in the first place? Sorry don't mean to heckle, just was skimming through the code and saw that line.
- azathothas 3y ago
  It's up to the pkg maintainer that's being used as the source. The default PKGs, located at: https://github.com/metis-os/hysp-pkgs https://github.com/metis-os/hysp-pkgs, are automated via GitHub actions. You can look at the workflow codes. As to answer the signing question: $BIN.TOML must contain either blake3sum or sha256sum of the binary specified as source. And once hysp downloads them, it checks if they match exactly as specified in the $BIN.TOML We prevent MITM or any other shenanigans by trusting whoever is hosting the pkg, isn't tampering both the binary and the checksums. So yes, not completely foolproof (an attacker could, in theory, tamper both the binary and the checksum), but that's why we have the self-hosting option for people who want to trust only themselves and their servers. The config allows you to specify different URL/Host for the TOML files and the actual binaries. So unless, both the TOML files and source binaries are being hosted on an HTTP site, MITM is not possible. And as already specified, the default source that ships with hysp, doesn't use HTTP anywhere.