News for hackers. Stuff that matters.

A comment on Dozens of malicious PyPI packages discovered targeting developers. Parent comment

Re:Dozens of malicious PyPI packages discovered targeting de... by namaria on Wednesday November 02, 2022 @02:51PM (#33441059)
It might be too cumbersome for most, and I might be more paranoid than average, but each project for me means a fresh VM, a new Keepass database and dedicated accounts. Then again I work mostly in ops, and I've seen first hand how badly things can go wrong so isolation and limiting blast radius takes precedence over daily convenience for me.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by bt1a on Wednesday November 02, 2022 @03:23PM (#33441554)
Could you please share some resources/tactics for protecting your host machine from these development VMs? If I were to do this, I would want some assurances (never 100%) that my host is protected from the VM to the best of my ability.

(If it makes any difference, I would probably be using VMWare Workstation Pro)

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by namaria on Wednesday November 02, 2022 @06:52PM (#33443973)
I can't give you what you're looking for. You need to decide on the trade offs for yourself. There will always be a risk. Directed attacks can get out of VMs. You could slip up and log into a personal account inside the VM.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by bt1a on Wednesday November 02, 2022 @09:53PM (#33445796)
I tried to make it clear in my reply that I understood there are no guarantees. What I’m asking is if you have any guidance on reducing the likelihood of these attacks succeeding
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by 0cf8612b2e1e on Wednesday November 02, 2022 @04:44PM (#33442668)
That does sound incredibly cumbersome. I suppose that means you are an ace at provisioning machines.

How do you move data in/out of the guests? I always found that part of interacting with VMs to be annoyingly painful.

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by namaria on Wednesday November 02, 2022 @06:54PM (#33444001)
There are always trade offs. You do get better at things you do a lot. My mother won't use a password vault because copying and pasting is too much work for her. I'd just rather pay with my time and inconvenience than one day find out some python package I fiddled with for a late night project once means I need to call my bank.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by fbhabbed on Wednesday November 02, 2022 @07:05PM (#33444096)
SSH.

Doesn't even need to be command line, you can just open remote addresses in your favourite graphical file browser, at least under Linux.

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by fsflover on Thursday November 03, 2022 @04:49AM (#33448520)
Why wouldn't you use disposable VMs [0] and secure inter-VM copy [1] on Qubes OS instead? It's much less cumbersome and more secure.

[0] https://www.qubes-os.org/doc/how-to-use-disposables/

[1] https://www.qubes-os.org/doc/how-to-copy-and-move-files/

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by AlexAndScripts on Friday November 04, 2022 @03:44PM (#33472687)
That sounds like precisely QubeOS's use case.
[ Parent | on HN ]