woodruffw

8 ms·

91.
by woodruffw 3mo ago
Very pedantic of me, but I figure it’s interesting to note: technically a release on PyPI can have zero files or even one or more wheels but no sdist. The former is a degenerate case that users don’t normally see, and the latter happens if
92.
by woodruffw 3mo ago
Yes, that would be a better setup and it’s exactly what PyPI is moving to[1]. This closes a gap in the legacy upload API, which evolved over time instead of being designed to avoid these kinds of problems. [1]: https://peps.pytho
93.
by woodruffw 3mo ago
Because uploads to PyPI are not atomic. They’re now capped within a 14 day window, but it would be extremely confusing to users to have the “release” hash of their dependencies change repeatedly. (Also: we’d need to determine what it even m
94.
by woodruffw 3mo ago
Files are immutable on PyPI, releases are not (because releases are comprised of a set of files, and files are uploaded one by one). This is unintuitive, but the TL;DR is that files will never change on PyPI, but (previously) a user could u
95.
by woodruffw 3mo ago
I’m not sure what this has to do with TFA: Python does have hash-pinning. TFA is not about modifying existing files on the index (PyPI doesn’t allow that), but about adding new files to a pre-existing release. But that doesn’t change th
96.
by woodruffw 3mo ago
The use case of uploading new wheels to an old release was actually (kind of) an accident: PyPI’s current upload API is stateless and originally there was only one file per release (sdists), so there was no need for a start-finish transitio
97.
by woodruffw 3mo ago
You do not have to compare atrocities to make a point.
98.
by woodruffw 3mo ago
> But the original claim is that it is all statically checked in Rust Where? The GP's comment says "prefers," which I didn't read to mean a blanket statement. I don't think anybody with more than passing experien
99.
by woodruffw 3mo ago
> When the Einsatzgruppen were "cleansing" conquered territory they at least had the decency to do so as humanely as possible. What a grossly offensive and patently false thing to say[1]. [1]: https://en.wikipedia.or
100.
by woodruffw 3mo ago
Yeah, that seems like a nice thing that Rust could offer. It strikes me as a weird thing to get hung up on, though, given that the norm in compiled languages - including C - is to express your bounds such that an optimizing compiler can (bu
101.
by woodruffw 3mo ago
How would Rust perform static checks on dynamic bounds? That seems like an impossible order, i.e. not a reasonable evaluation criteria for any (general-purpose) language. (I'm separately skeptical that it's the most important
102.
by woodruffw 3mo ago
I don’t think a judge would be impressed by this. If anything it actually makes the legal case easier: there’s a legitimate use for a wiping feature on a phone (e.g. for theft or tampering), but actively producing false information demons
103.
by woodruffw 3mo ago
I thought the standard for obtaining adverse/negative inference in a criminal case was higher than in a civil one, i.e. a judge will typically need more than just evidence that information was destroyed. But IANAL!
104.
by woodruffw 3mo ago
This would be under federal law, not Georgia law I believe. But even assuming it was under Georgia law: it hasn’t been entered into public evidence that the person in question knowingly destroyed anything. It’s entirely possible the phone h
105.
by woodruffw 3mo ago
I don’t agree about the “damage being done”: there’s no evidence that a cooldown is itself harmful. The worst thing it can do to you is deliver some updates to you slower-than-instantly.
106.
by woodruffw 3mo ago
I don’t think it makes a ton of sense for individual OSS maintainers to pay companies for security. The point of cooldowns is that they’re free and they trend towards security at no logistical cost to maintainers. (I agree that companies
107.
by woodruffw 3mo ago
The conventional meaning of “security theater” requires performance instead of effective action. But the author doesn’t reach that meaning: they claim that cooldowns don’t universalize , which then gets misconstrued into “security theater.
108.
by woodruffw 3mo ago
I think they mean "clear owners" as in "responsible individuals," not that the repos literally lacked people with merge approval rights.
109.
Readme, Not(blog.yossarian.net)
3 points by woodruffw 3mo ago|0 comments
110.
by woodruffw 3mo ago
I gave Shai Hulud as an example above. If you want precise timeline examples that demonstrate the efficacy of cooldowns, here’s some examples I collected last year[1]. (See the “Window of opportunity” column in the table.) [1]: https:&#x2F
111.
by woodruffw 3mo ago
To be clear, the RSA key thing isn’t really about it being a security issue — that’s a part of it, but the bigger point was that it reflects structural failure/inertia that’s commonplace in distribution packaging. (I am not a hater of
112.
by woodruffw 3mo ago
Well, yeah. There’s no package police that’ll stop you from installing malware. The argument has never revolved around that; the argument is solely that cooldowns are effective if you use them, and timely detection by third parties is str
113.
by woodruffw 3mo ago
I generally try not to name the companies directly, because I don’t want to give them free advertising. But you can look up e.g. the recent Shai Hulud campaign. > Just post one link of a "supply chain" problem that was prevente
114.
by woodruffw 3mo ago
If you google “supply chain security company” you will find various companies of various reputations vying for attention in this space.
115.
by woodruffw 3mo ago
Being unable to rotate the same weak RSA key for over a decade because it was too operationally cumbersome[1] does not strike me as “modern best practices.” I also don’t think any Linux distribution package maintainer would make a legally b
116.
by woodruffw 3mo ago
They are very fundamentally different solutions: the entire premise of distribution packaging is that you’re relying on some distribution maintainer’s discretion. It’s not an open index.
117.
by woodruffw 3mo ago
Fundamentally, this is a cat-and-mouse game. But I suspect that "time bomb" techniques aren't economically viable for attackers, at least not with current patterns: current attackers demonstrate "smash and grab" ten
118.
by woodruffw 3mo ago
The publishing topology is pretty fundamentally different: the entire power (and danger) of language package managers is that anybody can publish, not just a privileged few. (This cuts both ways: I’d say that distribution package managers h
119.
by woodruffw 3mo ago
> But if everyone will be delaying updates, won't be there less chances to catch it in time? No: the security assumption behind cooldowns rests on security scanning parties, not on innocent users being victimized. Three days is a sh
120.
Dependabot version updates introduce default package cooldown(github.blog)
209 points by woodruffw 3mo ago|143 comments

More ›