News for hackers. Stuff that matters.

A comment on Malicious PyPI packages stealing credit cards and injecting code. Parent comment

Re:Malicious PyPI packages stealing credit cards and injecti... by tikkabhuna on Tuesday August 03, 2021 @09:54AM (#28049196)
We use an artifact server and our build servers are completely airgapped. We know exactly what dependencies are used across the organisation. We can take centralised action against malicious dependencies.

I wouldn't bother having one if you're small (<25) people. If you start having a centralised Infosec group, then it starts to become necessary.

[ Parent | on HN ]
Re:Malicious PyPI packages stealing credit cards and injecti... by njharman on Tuesday August 03, 2021 @10:40AM (#28049770)
Airgaped? Really? Everytime a build happens someone physically moves a Thu drive or some other media too from the build server?

Airgap means not networked, even internally. Not just "blocked" from internet.

[ Parent | on HN ]
Re:Malicious PyPI packages stealing credit cards and injecti... by tikkabhuna on Tuesday August 03, 2021 @11:59AM (#28050804)
Wikipedia[1] offers a slightly relaxed definition, although I agree, I (and my colleagues) abuse the term.

The artifact repository server connects to the internet via a proxy. Build servers have no access to the internet.

[1] https://en.wikipedia.org/wiki/Air_gap_(networking)

[ Parent | on HN ]