3 ms·

> I can upload a package to PyPI, NPM or Crates.io without having to convince anyone that my project is worthy. This is a very good thing! It's a good thing fo

by tmtvl 2y ago

> I can upload a package to PyPI, NPM or Crates.io without having to convince anyone that my project is worthy. This is a very good thing! It's a good thing for me because I can upload my ransomware disguised as a file manager and people won't know it's ransomware until they run it. It's not such a good thing for my victims because they need to do their due diligence for each project instead of having a trustworthy maintainer vet it for them.

IshKebab 2y ago
That's doesn't make any sense for at least two reasons: 1. Maintainers don't thoroughly vet packages. You should know this from a certain recent event that was all over the news! 2. Projects that don't want to deal with the main apt repo just set up PPAs and tell you the commands to copy/paste to add their keys and the PPA.
- mid-kid 2y ago
  Are you sure you would've preferred the xz author to not have to jump through all the hoops they had to, and instead just press upload and boom everyone has it, like it has happened countless times in the node ecosystem? Maintainers are a first line of defense. They are users of the software just like us, and share the same interests. This means that most obvious misbehavior (not necessarily malware but just anything anti-user or just general bugginess) is caught before it has broader impacts. The fact xz made it into the news is because it was an anomaly, and even then its impact was reduced to only the unstable versions of debian and such. As for PPAs, you're right, adding a new repo means trusting a new set of maintainers. Thankfully only few software needs this so the amount you need to verify is relatively small.
  - uecker 2y ago
    Exactly, the xz issue is news because it (almost) by-passed the maintainers. For other packaging systems malware is already the norm.
- wakawaka28 2y ago
  Maintainers may not perfectly vet projects, but they do vet the projects that get added at least a little. Compare that to a repository where anyone can upload and promote actual virus software. PPAs at least require the user to explicitly trust the source of packages. If a distro releases a package, that is a tad more trustworthy than a random PPA, because at least the distro maintainers (very experienced people) thought it was good enough and not a virus. The distinction between "official" and "unofficial" is not there when it comes to all those language-specific repos. Also, typo-squatting is not a thing with official Linux repos, because maintainers know to not let it happen.

by tmtvl 2y ago

IshKebab 2y ago

That's doesn't make any sense for at least two reasons: 1. Maintainers don't thoroughly vet packages. You should know this from a certain recent event that was all over the news! 2. Projects that don't want to deal with the main apt repo just set up PPAs and tell you the commands to copy/paste to add their keys and the PPA.

mid-kid 2y ago
Are you sure you would've preferred the xz author to not have to jump through all the hoops they had to, and instead just press upload and boom everyone has it, like it has happened countless times in the node ecosystem? Maintainers are a first line of defense. They are users of the software just like us, and share the same interests. This means that most obvious misbehavior (not necessarily malware but just anything anti-user or just general bugginess) is caught before it has broader impacts. The fact xz made it into the news is because it was an anomaly, and even then its impact was reduced to only the unstable versions of debian and such. As for PPAs, you're right, adding a new repo means trusting a new set of maintainers. Thankfully only few software needs this so the amount you need to verify is relatively small.
- uecker 2y ago
  Exactly, the xz issue is news because it (almost) by-passed the maintainers. For other packaging systems malware is already the norm.
wakawaka28 2y ago
Maintainers may not perfectly vet projects, but they do vet the projects that get added at least a little. Compare that to a repository where anyone can upload and promote actual virus software. PPAs at least require the user to explicitly trust the source of packages. If a distro releases a package, that is a tad more trustworthy than a random PPA, because at least the distro maintainers (very experienced people) thought it was good enough and not a virus. The distinction between "official" and "unofficial" is not there when it comes to all those language-specific repos. Also, typo-squatting is not a thing with official Linux repos, because maintainers know to not let it happen.