4 ms·
> PyPI or rubygems These are not activities which a web server does though. These are activities usually triggered by developers or administrators, not by web
by ultramancool 11y ago
> PyPI or rubygems
These are not activities which a web server does though.
These are activities usually triggered by developers or administrators, not by web servers remotely and they have to do with a web application, not a web server.
And even then, for this attack to be meaningful you'd need to have active MITM between the server and PyPI or rubygems at the time when the developer or administrator was updating this. In a good datacenter, this should not be possible. Employees of the DC and national security agencies, which may be able to perform active attacks in such datacenters would probably be the biggest risk.
- d_theorist 11y ago>And even then, for this attack to be meaningful you'd need to have active MITM between the server and PyPI or rubygems Yeah. Which is pretty much the thing (or one of the things anyway) that TLS is supposed to prevent! >These are activities usually triggered by developers or administrators, not by web servers remotely and they have to do with a web application, not a web server. Some strange distinctions. A server running a web application may well want to make requests to PyPI when being provisioned.
- KayEss 11y agoThis should only be the case for the build server that creates the packages that get installed on production.
- d_theorist 11y agoMaybe that's how you do it, but I guarantee that there are loads of production webservers out there grabbing stuff from all over the web and building it in situ.