TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Backdoor in ssh-decorator package

50 pointsby jbfooabout 7 years ago

5 comments

lrvickabout 7 years ago
The solution to the impersonation aspect of this is commit signing. It is literally built into Git. There are no good excuses for project maintainers to not sign commits at this point. Grab a yubikey or other gnupg smartcard and do it. Else someone is going to impersonate you and use your name, reputation, and repos to spread malware like this. Have your git hosting provider refuse unsigned commits (github&#x2F;gitlab allow this).<p>Secondly stop trusting pip&#x2F;pypi. You -can- upload gpg package signatures but clients totally ignore them. There is no way to verify the author of a pip package except by hand today.<p>Let me be really clear here. When you install a pip package you are executing arbitrary code from the internet with unknown authorship.<p>Pip is fundamentally broken until signature validation is implemented. Whenever possible use OS package managers like apt which actually verify authorship and integrity.
评论 #17029792 未加载
评论 #17030813 未加载
amingilaniabout 7 years ago
That is such a dick move. There should be a blacklist of people that pull these kinds of stunts. I understand that blacklists aren&#x27;t Sybil resistant but they&#x27;re better than nothing. At the very least the scum would have to rebuild their reputation.
评论 #17027454 未加载
评论 #17028437 未加载
jwilkabout 7 years ago
Maintainer&#x27;s response:<p><a href="https:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache:vjUIkPX1-0EJ:https:&#x2F;&#x2F;github.com&#x2F;urigoren&#x2F;ssh_decorator&#x2F;issues&#x2F;11%2B%22ssh-decorate.cf%22" rel="nofollow">https:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache:vjUIkP...</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;pypa&#x2F;warehouse&#x2F;issues&#x2F;3896#issuecomment-387184492" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pypa&#x2F;warehouse&#x2F;issues&#x2F;3896#issuecomment-3...</a>
评论 #17030106 未加载
parliament32about 7 years ago
The module starts with &quot;import requests&quot; which should be a red flag even for a cause skim of the source. The &quot;it&#x27;s open source, I&#x27;m sure someone else read over it&quot; excuse only works when the code is popular enough... and some obscure pip package definitely isn&#x27;t.<p>The author of the package claims to be a &quot;victim&quot; here, but it&#x27;s hard to tell. Too bad pip doesn&#x27;t support package signing.
craftyguyabout 7 years ago
Two questions:<p>1) can paramiko.RSAKey handle other encryption schemes (ED25519) ? If not, folks using non-RSA keys wouldn&#x27;t be affected..<p>2) Having a (strong) passphrase for your key file would help prevent the perp from doing any harm with the key(s), or at the very least would give you time to invalidate the key(s). Right?
评论 #17030170 未加载