87
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Jan 2025
87 points (97.8% liked)
Privacy
32177 readers
431 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
python dependencies, like all scripting language dependencies, must not be installed via the system package manager. yes python's package management is bad, but if package maintainers for nix are not following best practices then honestly that's their problem, not the tooling's. this is python packaging 101.
also, malicious PRs being accepted due to ml people being famously bad at actual software engineering is not a "supply chain attack". and they are definitely not worse than npm, because the problem wasn't in pypi. pypi is historically really good at preventing this sort of thing, but what can you do when the actual, well-formed release approved and pushed by the actual maintainers has a cryptominer in it?
Wat. You are saying you can’t package Python application on a system level? That means the language’s package managament is broken. Nix unlike most package managers can do a reasonable job juggling multiple version of packages at the same time & stuff still breaks, & more frequently than anything in any other language other than Haskell.
There was also the SolarWind attack, Colorama, JarkaStealer, Cobo, pywx, Dropbox, PyTorch 2023. Zero-days galore.
you can, you just need to use the built-in tooling to build a self-contained application like a zipapp. if package maintainers did that it would break less. but they don't, and the problem there is how big the packaging tooling is.
like, imagine trying to install a js-based program the same way as you describe, pulling each dependency from apt. it would break immediately.
also, none of those listed ones used the package index as the vector. solarwind had their own infrastructure compromised, colorama was a typosquatting attack, jarkastealer was malicious from the word go. the list goes on, none of these are packaging system failures.
he problem npm has had for ages is that people are taking over legitimate packages and adding malicious code into them downstream from development using npm, and that the js ecosystem favours many small dependencies which makes the attack surface huge.
now, if all of those you listed was due to revival hijacking it would be pypi's problem, but that only works if the original dev removes their package. as it is, all of it is upstream of pypi. it's bad opsec by the devs.