Here's how (as a company) you protect yourself against these types of supply chain attacks: 1. Host your own internal registry. 2. The packages in there are actually vetted by your security team (that's way more important than you might think). At the same time you can also ensure to actually comply with the licenses of these packages (you would be surprised at how often it happens that developers just forget that; here a reminder: if you use an MIT licensed software, you need to give credit; if you have a hundred dependencies with that licenses, that goes for every single one). 3. If a developer needs a new package, they tell that team and until it's in there do some other ticket (you probably have a few hundred anyway).

"they're self promoting..." an open source solution to an actual problem, with a well-written article explaining the problem

The perfect code interview: > cargo add postgress Then > cargo run And you get > "Joke!)" You passed the test blazingly fast!

Package names like fast-postgres would probably work as well. Who doesn't love blazingly fast stuff?

I like Golang's way of not having a centralized registry. Importing from GitHub etc makes it much more difficult for typosquatting to work since you'll most likely be copy&pasting.

9:12 Docker as the devs themselves said is NOT a sandbox and should never be used as one

"Joke!)" - Russian smiley

Why in the name of all that's holy wasn't crates designed to be nested-named so that squatters have to squat the distinctive top-level names of the individual devs or companies?

blazingly safe malware

This is horrifying. I'm already extremely paranoid at work about adding any package but seeing this is doubling my paranoia.

Good to see security getting some love on this channel.

Package managers are like double-edged swords with blades for handles.

Idiotic consolation for us C++ developers: dependencies are so hard to get in your project (you need to be a senior CMAKE developer), it's not worthy to have malware injected in libs....

man, prime should make a tps display, im pretty sure we are getting close to 1 tear per second

Now you have to run a virus scanner on rust projects. Ha.. Rust..and the corruption begins. "With great adoption, will come the criminals to subvert it, and then the government that claims to protect you". Rust needs to create an official [cargo/rust cache daemon], so downloaders can pull all files over the network into a directory or partition. Then the company runs their own virus scanners against rust downloads. Most (smart) companies create a NAS, NFS, squid and scan the h311 out of it. But somebody in rust needs to package that up into a plugin or script or installer. If everyone is scanning their local directory, then malware might have a higher probability to be found on the zero day. Maybe setup a company wide nfs||[NAS] that everyone uses to save and pull files. Either way, this event happens to create a great argument to appoint a czar to authorize crates. Just like the plan...LOL. It probably was someone in N.Korea or a poser. This is a real good video for the Pen Testers out there.

Surely it must be possible to detect most potential typosquatting based on heuristics or some clever computer science magic. You should not even be allowed to create packages with similar names in the first place, this seems like an easy win that could be implemented by the crates team. Even if they implemented that rule only for packages with over a certain amount of installs that would already be a huge improvement.

This is why I don't like Rust and Go. It's just so trivial to end up downloading a whole ton of stuff, often directly from the repo. Sometimes even stupidly at a tag (like 'master') that allows the repo owner to change what you get at any time. Python is a little better, but still doesn't let you name dependencies by hash (which at least Go and Rust can do even if people stupidly don't do it).

This is a pretty close analog to a system I was thinking about making as a stretch goal for an SDK.

"No one. Rust in production doesn't exists" *Rust in production developers* 😴

Saw this in rust weekly

Those who trade privacy for safety will have neither.

if you write software in way that you install packages because their name seems fitting functionality you need, you are not developer.

Here's how you do it... make an actual useful package... say left-pad. Have it dormant for a few years and then BOOM. I'd be surprised if we npm isn't already a minefield waiting to explode

What's that IDE in the background?

Why we don't impress more on IRC I don't know 😅

In python dashes and underscores in a package name are equivalent

I prefer the word hyphen over the word dash. And I like hyphens much more than underscores.

only a few mins in but yea thats some sneaky nefarious s*hit

damn man maybe that's why go stick to pure go instead of relying on packages

More appropriately, it should be Post-Grease or Post-Grese.

i don't like package services, just use urls

Big fan prime!

Crates should have hashes that have to be copy/pasted manually before installing. By doing so you also know for sure that the content isn’t altered. Npm’s ‘^’ for versioning is the worst thing that happened to dev world.

It's not open source. This story is an advertisement, I'm afraid. Is there a significant difference between a crate with "telemetry" that talks to a server where a company sells anonymized data, and a "security" scanner server API that collects data? If it was a third-party reporting this, or if the server code was open (e.g., AGPLv3), I'd have been more credulous. But this doesn't sound like a good idea.

To evict typosquatters crates io should prevent/ban package names that are string distance

openai's website sucks? hmmm. what else is it supposed to do? why does it suck?

NK is based

a

first actually second

fourteenth