3 ms·

Why this still happens? Why after many previous supply-chain attacks maintainers of package repositories still allow anyone uploading packages and pushing updat

Why this still happens? Why after many previous supply-chain attacks maintainers of package repositories still allow anyone uploading packages and pushing updates without security audit?

surajrmal 2mo ago
Who is funding this security audit? Are folks supposed to volunteer their free time? It's a difficult coordination problem. The best folks have come up is to delay adopting new releases by a few days and hope your dependency is popular enough that a security firm audits it for you in that timespan. If you have enough money I suppose you can start employing llms to audit things for yourself.
- bcjdjsndon 2mo ago
  > Who is funding this security audit? Are folks supposed to volunteer their free time? Same people who keep the whole rust project going, a lot of those are volunteers aren't they? Not mad to think they could do the same for core packages at least
  - aw1621107 2mo ago
    > Same people who keep the whole rust project going, a lot of those are volunteers aren't they? Sure, but from my understanding the Rust project is generally "bottom-up" in that volunteers generally work on what they want to rather than submit their time into a pool for some kind of higher-level management to direct.
  - mirashii 2mo ago
    It’s absolutely mad and extremely entitled to expect that a volunteer group of developers do an order of magnitude or more additional work for no additional pay or benefits to themselves.
    - mabini 2mo ago
      [flagged]
  - nicoburns 2mo ago
    The core packages (things like rand and regex) are pretty closely audited in practice (albeit it might not catch a credential compromise). This crate isn't one of them.
    - lyu07282 2mo ago
      > This crate isn't one of them. still caught in hours though, so just as a general rule: never install anything newer than 7 days old packages cargo feature for this is still unstable infuriatingly: https://github.com/rust-lang/cargo/issues/17009 https://github.com/rust-lang/cargo/issues/17009
- renox 2mo ago
  > It's a difficult coordination problem. Well, it depends on the language: language which "capabilities" (both for the source code and for the building* ) could in theory really reduce a lot of the burden to identify supply chain attacks. *: some research language have/had capabilities which would make supply chain attack "obvious" but for build systems I don't know if this exist.
- Panzerschrek 2mo ago
  Languages like Rust have sources of income to be able to finance such audit. You don't need to audit all the crap is being uploaded right now. Only really necessary and widely-used packages should be managed in a centralized way, so, auditing all of them isn't that huge task.
weinzierl 2mo ago
Mozilla, Google and a couple of others are publishing their audits through cargo vet. There are also additional audits done by individuals you can use through cargo crev. Overall the number of audited crates is in the thousands and you will find audits for most of the popular crates. In the end it is your decision to use unaudited or refuse unaudited crates.
- Panzerschrek 2mo ago
  > In the end it is your decision to use unaudited or refuse unaudited crates. It should be the default behavior of the package manager to allow downloading only audited/trusted packages. Forcing end-users of the language to be responsible for audit of all dependencies is impractical.
  - weinzierl 2mo ago
    If you want that you can always use vetted package repositories like Nexus. Many companies do.

Why this still happens? Why after many previous supply-chain attacks maintainers of package repositories still allow anyone uploading packages and pushing updates without security audit?

surajrmal 2mo ago

Who is funding this security audit? Are folks supposed to volunteer their free time? It's a difficult coordination problem. The best folks have come up is to delay adopting new releases by a few days and hope your dependency is popular enough that a security firm audits it for you in that timespan. If you have enough money I suppose you can start employing llms to audit things for yourself.

bcjdjsndon 2mo ago
> Who is funding this security audit? Are folks supposed to volunteer their free time? Same people who keep the whole rust project going, a lot of those are volunteers aren't they? Not mad to think they could do the same for core packages at least
- aw1621107 2mo ago
  > Same people who keep the whole rust project going, a lot of those are volunteers aren't they? Sure, but from my understanding the Rust project is generally "bottom-up" in that volunteers generally work on what they want to rather than submit their time into a pool for some kind of higher-level management to direct.
- mirashii 2mo ago
  It’s absolutely mad and extremely entitled to expect that a volunteer group of developers do an order of magnitude or more additional work for no additional pay or benefits to themselves.
  - mabini 2mo ago
    [flagged]
- nicoburns 2mo ago
  The core packages (things like rand and regex) are pretty closely audited in practice (albeit it might not catch a credential compromise). This crate isn't one of them.
  - lyu07282 2mo ago
    > This crate isn't one of them. still caught in hours though, so just as a general rule: never install anything newer than 7 days old packages cargo feature for this is still unstable infuriatingly: https://github.com/rust-lang/cargo/issues/17009 https://github.com/rust-lang/cargo/issues/17009
renox 2mo ago
> It's a difficult coordination problem. Well, it depends on the language: language which "capabilities" (both for the source code and for the building* ) could in theory really reduce a lot of the burden to identify supply chain attacks. *: some research language have/had capabilities which would make supply chain attack "obvious" but for build systems I don't know if this exist.
Panzerschrek 2mo ago
Languages like Rust have sources of income to be able to finance such audit. You don't need to audit all the crap is being uploaded right now. Only really necessary and widely-used packages should be managed in a centralized way, so, auditing all of them isn't that huge task.

weinzierl 2mo ago

Mozilla, Google and a couple of others are publishing their audits through cargo vet. There are also additional audits done by individuals you can use through cargo crev. Overall the number of audited crates is in the thousands and you will find audits for most of the popular crates. In the end it is your decision to use unaudited or refuse unaudited crates.

Panzerschrek 2mo ago
> In the end it is your decision to use unaudited or refuse unaudited crates. It should be the default behavior of the package manager to allow downloading only audited/trusted packages. Forcing end-users of the language to be responsible for audit of all dependencies is impractical.
- weinzierl 2mo ago
  If you want that you can always use vetted package repositories like Nexus. Many companies do.