When you install un-signed code into your editor, it might as well be malware

Re:When you install un-signed code into your editor, it migh... by danso on Saturday December 26, 2015 @01:57PM (#10794842)

Was hoping to see a mention of Sublime Text...because I most definitely haven't taken the time to audit the packages I install, nor do I even really have much insight to how the central package repository is maintained. I did a couple of Google searches for "sublime text package malware"/security/sandbox and didn't see articles specific to the topic.

[ Parent | on HN ]

Re:When you install un-signed code into your editor, it migh... by wbond on Saturday December 26, 2015 @04:04PM (#10795312)

Package Control protects package information in transit using TLS, verifies TLS hostnames, and requires that package metadata source URLs are HTTPS. The source URLs for package information are all tracked in an open source repo on GitHub.

For the past couple of years a volunteer who goes by the handle FichteFoll does most of the review process, and I tend to fill in when he is unavailable. We check for common packaging issues, areas of confusion for users and sometimes even code suggestions.

In terms of hosting, it is all done via a private server that I run, configured to only allow TLS 1.0+ connections. I am the only user with access to the box.

All of this is to say that Package Control generally tries to vet packages to get them info the default channel, and then protects them in transport. However, packages are in no way audited, and could (obviously) be subverted by anyone with access to the original source code repo/hosting.

[ Parent | on HN ]

Re:When you install un-signed code into your editor, it migh... by bpicolo on Saturday December 26, 2015 @02:53PM (#10795040)

The default list is here: https://github.com/wbond/package_control_channel

Anybody can pull request, maintainers tend to review the package briefly.

I've published a sublime package, when I PR'd the guy actually looked at my code pretty thoroughly and had some helpful advice. It was a really good open source experience.

[ Parent | on HN ]

Re:When you install un-signed code into your editor, it migh... by adrianN on Saturday December 26, 2015 @02:32PM (#10794966)

Sublime Packages are just Python modules. I don't believe there is any sandboxing. At the very least I know that you can use popen and run arbitrary programs.

[ Parent | on HN ]