News for hackers. Stuff that matters.

A comment on PyPI: Python packets steal AWS keys from users. Parent comment

Re:PyPI: Python packets steal AWS keys from users by Pv9KKy3 on Sunday June 26, 2022 @07:43PM (#31889162)
Yeah, I'd love to have a decorator at the top of a file - @env to provide access to env variables or @secrets for some kind of secrets access, nothing else gets this.

Python is tough though, a very dynamic language so probably kind of hard to lock it down.

[ Parent | on HN ]
Re:PyPI: Python packets steal AWS keys from users by Beltiras on Monday June 27, 2022 @06:33AM (#31892657)
You would normally be able to solve things like this via file permissions in the OS but currently we are running everything as root inside a container.
[ Parent | on HN ]
Re:PyPI: Python packets steal AWS keys from users by Pv9KKy3 on Monday June 27, 2022 @07:40AM (#31893153)
Not really, because the dependencies to your python code often have access to all global variables and/or run at same permission level as all your code etc.
[ Parent | on HN ]