4 ms·
I don't understand this argument, unless you include things like gem, pip, npm, etc. `pip install foobar-py` runs a Python setup script, which can do anything
by bretthoerner 14y ago
I don't understand this argument, unless you include things like gem, pip, npm, etc.
`pip install foobar-py` runs a Python setup script, which can do anything bash can. Do you inspect all of those, and comment about their insecurities on HN?
- ohazi 14y agoDon't these generally do some sort of cursory signature check?
- lotyrin 14y agoAgainst a signature they fetched how? Over HTTPS? Just because this style makes you think about it harder, doesn't mean it's less secure. It's the simplest and best case.
- sergiosgc 14y agoThis method makes you vulnerable to attacks that change the script being run. DNS spoofing, HTTP proxy hacking or hacking of the source server itself. Good package management systems use digital signatures to ensure that the original package wasn't tampered with. Not that hacking of the central repositories never happened, but it's a major (and thus infrequent) event.
- timdorr 14y agoBut I know for at least gem and npm, while they support signing, they are not used in practice. And those two repositories are used by a large number of people browsing this site.