Malicious PyPI packages stealing credit cards and injecting code

Re:Malicious PyPI packages stealing credit cards and injecti... by goodpoint on Tuesday August 03, 2021 @12:57PM (#28051474)

> pip provides isolation between workspaces that apt has never been able to do natively because it's too generic

This is hardly a concern on production systems. It's been common practice for decades to deploy each service on a dedicated host, or at least a VM in order to have a degree of security isolation. [or a container if you don't care]

> npm, cargo, etc showed how to include a dependency multiple times at different versions

And this is why they cannot provide stable releases and security backports.

If you want security updates you can use Debian or pay $$ for SuSE or Red Hat or $$$$ for custom support from some tech companies, but they will mostly support one version per package.

The combinatorics explosion of packages times versions on archives like npm or pypi makes it prohibitively expensive to reliably patch and test every combination of packages and versions.

Debian has been pioneering reproducible builds and automated installation CI/QA and it still took a lot of effort to get there.

> I don't think the system you want (isolation, version freedom, but with safe/vetted packages) is going to be something that's possible to evolve out of any of the current systems.

I don't want version freedom: it's not attainable. It's not a software problem, it's a math problem.

> It's got to be something that goes back to first principles.

Any idea?

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by mikepurvis on Tuesday August 03, 2021 @01:30PM (#28051851)

If you don't want or need version freedom, what is it about the existing deb/rpm ecosystems that don't work for you, either on their own or in conjunction with the various tools that bridge other ecosystems into them? (I'm a fan of dh_virtualenv, myself)

Or is your lament that the world as a whole is worse off because others have eaten of the fruit of systems like npm and pip?

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by goodpoint on Tuesday August 03, 2021 @02:04PM (#28052175)

The latter, albeit it's not "the world as a whole", but some tech bubble. Various large companies prohibit pip/npm/docker.

(and here I'm even getting downvoted for going against the hivemind)

I can only hope that after enough software supply chain attacks the industry will realize that distros were right all along.

[ Parent | on HN ]