3 ms·
A few years ago, my company found hundreds of internal projects using the malicious "python3-dateutil" library. One instance was ultimately used to get full ATO
by jimt1234 3y ago
A few years ago, my company found hundreds of internal projects using the malicious "python3-dateutil" library. One instance was ultimately used to get full ATO of an AWS account and launch hundreds of EC2 instances to mine crypto. So, the threat is real, even if it is overstated by "companies capitalizing on supply chain security fears".
- woodruffw 3y agoI agree that the threat is real. But I think the threat needs to be quantifiable in terms of metrics that aren’t solely the attacker’s ability to spam the index. Put another way: what matters is that the attacker can get arbitrary code to run on your machine, not that they can unload arbitrary package-shaped things to a publicly accessible package index. The former can be solved; the latter isn’t solvable in the general case.
- delusional 3y agoI liken it to hosting malware on the open internet. Yes the internet can serve malware, duh, that's the point. You can share whatever you want over the internet and we wouldn't want it any other way. What matters is who you can get to download and execute it. And what they can do with that remote code execution. As always, the most secure system is the system that doesn't exist. Every other security argument has to contend with our desire to do useful stuff, and therefore it has to begin with a credible attack vector. Not just a hunch or some notion that it's "security best practice".