Re:Backdooring Rust crates for fun and profit
by not2b on Thursday November 18, 2021 @11:36AM
(#29267374)
Robustly verifying identity isn't enough, because a developer with an outstanding reputation could lose their credentials to a spearphishing attack, and the attacker could then modify crates using stolen credentials.
[ Parent
| on HN ]
Re:Backdooring Rust crates for fun and profit
by rectang on Thursday November 18, 2021 @12:10PM
(#29267787)
I agree that authentication is not sufficient on its own, but I argue that it's necessary as part of the solution.
A source package should meet the following criteria:
• Package contents match exactly the source tree at a PGP signed commit at a public repository URL. This must be verified before the package is made available through the package manager.
Now, if I am whitelisting PGP keys, an attacker needs to steal creds to get something by me.
Ideally you want multiple signatures by trusted keys prior to publication. Each additional signature makes it significantly less likely that a package is provided by a malicious attacker.
EDIT: Hmm, how about package signing parties held over videochat? If we already know each other and you tell me that a particular package was created by you, I sign it.