ashishbijlani

13 ms·

31.
by ashishbijlani 3y ago
Would love to know the specifics I'm missing. Based on my experience, Docker/FC just works out of the box and gives you a shell.
32.
by ashishbijlani 3y ago
> There's Firecracker, which I believe is secure (AWS built it for Lambda after all) but good luck figuring out how to run that on a Mac. Then, how about using AWS Lambda for your use case?
33.
by ashishbijlani 3y ago
Curious to know why existing sandboxing/isolation technologies like VMs & Containers not enough here?
34.
by ashishbijlani 3y ago
Interesting. I wonder if this is also true for available/existing commercial/open-source PyPI mirroring solutions [Edited].
35.
by ashishbijlani 3y ago
A high-latency network will certainly become the bottleneck, but ONLY for file reads/writes. Metadata attributes (e.g., symlinks, dentries, inodes) are maintained by the file system (FUSE). Caching them in the kernel with ExtFUSE will
36.
by ashishbijlani 3y ago
FUSE does not work well with a large number of small files (due to high metadata ops such as inode/dentry lookups). ExtFUSE (optimized FUSE with eBPF) [1] can offer you much higher performance. It caches metadata in the kernel to avoid
37.
by ashishbijlani 3y ago
This is something we have noticed as well in our supply-chain security analysis of Github repos. It could be "build it in the open" philosophy as well that offers complete transparency and security audibility.
38.
by ashishbijlani 3y ago
We’ve built an open-source tool, called Packj [1], to offer developers more insights into packages, such as risky install hooks, embedded binary blobs, and other malicious/risky packages. It performs static/dynamic/metadata a
39.
by ashishbijlani 3y ago
Plug: I've been building Packj [1] to detect dummy, malicious, abandoned, typo-squatting, and other "risky" packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as num funcs&#x
40.
by ashishbijlani 3y ago
We carried out a similar analysis using Packj tool [1] and found that a large number of repos are vulnerable to supply-chain attacks. We received a bunch of bounties for reporting vulnerabilities. Hopefully, these findings will bolster open
41.
by ashishbijlani 3y ago
Packj [1] flags malicious/risky NPM/PyPI/RubyGems packages by carrying out static analysis and looking for capabilities/permissions (diff from runtime permission enforcement). Supporting VSCode/browser extensions is
42.
by ashishbijlani 3y ago
This is a great idea! What have been your findings comparing packaged code vs repo code? If you're interested, I'd love to integrate this in Packj tool. 1. http://github.com/ossillate-inc/packj flags vulnerab
43.
by ashishbijlani 3y ago
The project is active (just not merged in the kernel yet). Please DM me for questions.
44.
by ashishbijlani 3y ago
I'm working on optimizing FUSE using eBPF (ExtFUSE [1]) and adding a caching layer exactly as you mentioned. Will post publicly when ready. 1. https://github.com/extfuse/extfuse
45.
by ashishbijlani 3y ago
I built Packj [1] sandboxing for securing “pip/NPM install”. It uses strace for sandboxing and blocks access to sensitive files and limits traffic to known-good IP addresses. 1. https://github.com/ossillate-inc/pac
46.
by ashishbijlani 4y ago
Great work! This provenance check is going to be very valuable for enforcing supply-chain security. We are working on adding support to check for provenance in Packj. 1. https://github.com/ossillate-inc/packj flags ris
47.
by ashishbijlani 4y ago
Cool project. Would love to integrate this in Packj [1] as one of the open-source SAST scanners. Will DM you. 1. https://github.com/ossillate-inc/packj flags malicious/risky open-source dependencies.
48.
by ashishbijlani 4y ago
Plug: I've been building Packj [1] to detect dummy, malicious, abandoned, typo-squatting, and other "risky" packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as num funcs&#x
49.
by ashishbijlani 4y ago
We've made it highly customizable [1]. For some folks, a package that has not been updated for a while could be classified as abandonware. You can turn off the alerts that do not apply to you by commenting out in .packj.yaml file. We&#
50.
by ashishbijlani 4y ago
AFAIK, SIP only blocks dtrace on system executables (i.e., that ship with Mac). But there are alternatives as well such as Endpoint security: https://developer.apple.com/documentation/endpointsecurity/
51.
by ashishbijlani 4y ago
A number of academic researchers (including us) have studied malware samples from past open-source supply chain attacks and identified code/metadata attributes that make packages vulnerable to such attacks. Packj scans for several such
52.
by ashishbijlani 4y ago
We’ve built Packj [1] to detect packages with install hooks, embedded binary blobs, and other such malicious/risky packages. It performs static/dynamic/metadata analysis to look for "suspicious” attributes. 1. https:&#x
53.
by ashishbijlani 4y ago
Yes, strace works on Linux. Mac has dtrace that we will integrate. Packj sandbox should, however, also work under WSL on Windows. May be someone can test and share contributions.
54.
by ashishbijlani 4y ago
You're right; a sophisticated bad actor can employ time- or event-based hiding techniques. However, these limitations apply to dynamic/runtime analysis only. Packj performs static+dynamic+metadata analysis. As static analysis scan
55.
by ashishbijlani 4y ago
> people you're trying to sell a shovel to don't want to dig. That's exactly where a tool like Packj can help. It can cut the digging time down significantly. Auditing hundreds of direct/transitive dependencies manual
56.
by ashishbijlani 4y ago
The problem with using downloads as a proxy for "safety" is that a bad actor can use CI infra/bots/scripts to inflate the number. This is why in Packj [1] we check for multiple attributes (e.g., dependents). 1. https:&#
57.
by ashishbijlani 4y ago
This is a valid concern. That is why we're building this in the open. You can take a look at the code. We welcome your feedback/suggestions and code contributions to add new security checks/policies.
58.
by ashishbijlani 4y ago
Plug: We've been building Packj [1] to detect such malicious, abandoned, typo-squatting, and other "weak links" in your software supply chain. Supports auditing as well as install-time sandboxing of PyPI/NPM/Ruby pa
59.
by ashishbijlani 4y ago
"This site is blocked due to a security threat that was discovered by the Cisco Umbrella security researchers."
60.
by ashishbijlani 4y ago
Thanks for posting this! I'm the lead developer. I've been building Packj to empower developers/security engineers to easily audit third-party open-source dependencies for supply chain attacks. Please allow me to highlight a

More ›